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ABSTRACT 

In massively collaborative projects such as scientific or com- 
munity databases, users often need to agree or disagree on 
the content of individual data items. On the other hand, 
trust relationships often exist between users, allowing them 
to accept or reject other users' beliefs by default. As those 
trust relationships become complex, however, it becomes dif- 
ficult to define and compute a consistent snapshot of the con- 
flicting information. Previous solutions to a related problem, 
the update reconciliation problem, are dependent on the or- 
der in which the updates are processed and, therefore, do 
not guarantee a globally consistent snapshot. 

This paper proposes the first principled solution to the au- 
tomatic conflict resolution problem in a community database. 
Our semantics is based on the certain tuples of all stable 
models of a logic program. While evaluating stable models 
in general is well known to be hard, even for very simple logic 
programs, we show that the conflict resolution problem ad- 
mits a PTIME solution. To the best of our knowledge, ours 
is the first PTIME algorithm that allows conflict resolution 
in a principled way. We further discuss extensions to nega- 
tive beliefs and prove that some of these extensions are hard. 
This work is done in the context of the BeliefDB project at 
the University of Washington, which focuses on the efficient 
management of conflicts in community databases. 

1. INTRODUCTION 

In many scientific projects today, a community of users 
is working together to assemble, revise, and curate a shared 
data repository. Since the true state of the world is generally 
not known in many scientific disciplines, users will often have 
not just overlapping but also conflicting beliefs about the 
world. Hence, as the community accumulates knowledge 
and the database content evolves over time, it will inevitably 
contain conflicting information. An example domain with 
highly disputed and still changing beliefs is the current state 
of knowledge on the Indus script [17] . 
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Figure 1: Origins of three Indus glyphs as asserted 
by archeologists Alice, Bob and Charlie (a). Alice's 
beliefs after applying trust mappings from [Flg. 2| (b). 



Example 1.1 (Indus script). The Indus civilization 
flourished about 2600 to 1900 B.C. in what is now eastern 
Pakistan and northwestern India. No historical informa- 
tion exists about the civilization, but archaeologists have un- 
covered samples of their writing on stamp seals, sealings, 
amulets, and small tablets. To this day, the script on these 
objects remains undeciphered and various claims of deci- 
pherments have been put forward. One important step in 
such interpretations is determining the "origin" of the glyph 
which is the actual motif that was stylized into the glyph. 
For example, the origin of the glyph \J has been attributed 
by different archeologists^ to be either a ship hull, a cow, 
or a jar. Similarly, the glyph 1^ has been interpreted to 
originate from a fish or a knot, whereas the glyph f is 
widely agreed to represent an arrow \15^. The current state 
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of knowledge can be represented in a relational table Fig. la) 
where conflicting beliefs of researchers (here simplified with 
Alice, Bob and Charlie) are represented by tuples (here tu- 
ples bi to be ) with partial key violations, highlighting the lack 
of agreement among archeologists. 

Recent work has proposed trust mappings between users 
in order to support collaboration and data sharing [l9]. A 
trust mapping is a statement that a user is willing to accept 
another user's data value. Priorities are further used to spec- 
ify how to resolve conflicts between data values coming from 
different trusted users. [Figure 2] illustrates three trust map- 
pings, two defined by Alice (mi and 7712) and one defined 
by Bob (ma). [Figure 15] shows Alice's version of the data 
after applying these mappings to |Example 1.1| The second 
and third tuples result from her trust of Bob and Charlie. 
Where they disagree (on {), ), Alice sees Bob's value (fish) 
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instead of Charlie's value (knot) because she assigned to Bob 
a higher priority (100) than to Charlie (50)^. 

Several systems have adopted some form of conflict han- 
dling or trust mapping in order to facilitate data sharing 
among users /Tj |9j ^lT\ [l6 19 (see Fig. 3 for a comparison of 
their featuresjT However, providing a consistent semantics 
to a set of trust mappings is a challenging problem. The 
current state of the art is the approach taken by the Orches- 
tra system in the context of update exchange [o]. Updates 
are treated one at a time, in a First-In First-Out manner. 
When an update is published by a user, the new value is 
propagated according to the trust mappings to other users, 
and conflicts are resolved based on the priorities. At each 
moment, a user is provided with a snapshot of the current 
database, according to other users' beliefs and her own trust 
relationships. However, this snapshot may be inconsistent 
because (i) it depends on the order in which the updates are 
processed, and (ii) it may become inconsistent as a result of 
other updates. 

Example 1.2 (Indus script continued). Consider the 
following sequence of updates starting with an empty database: 
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Charlie is the first user to insert the origin of \J as jar, 
which propagates to Alice and Bob. When Bob inserts cow, 
the system fails to propagate this to Alice because she already 
has a data value acquired at an earlier timestamp. Thus, Al- 
ice continues to see jar. This is inconsistent, because Alice 
trusts Bob more than Charlie. Had the updates been per- 
formed in reverse order (first Bob inserts cow then Charlie 
inserts jar) then Alice would end up with cow. Thus, the 
snapshot for Alice depends on the order in which the up- 
dates are performed, which is undesirable. One may attempt 
to address that by storing the lineage of each data value: the 
system could then update Alice's value because it knows it 
came from Charlie. However, maintaining the lineage of all 
values in a large system is difficult, because an update to one 
value may affect the lineage of many other data values. 

A second problem is that update propagation cannot handle 
updates or revocation of data values. Consider the following 
sequence, again starting from an empty database: 
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Both Alice and Bob import jar from Charlie, and both should 
update their belief when Charlie updates his to cow. How- 

^Note that priorities are assigned by users and only serve to 
impose a total preorder on their trusted parties. Priorities of 
mappings assigned by different users, e.g. m2 with priority 
50 and ma with priority 80, cannot be compared. 




mi: Alice(fc,u) 
m2: Alice(fc,u) 
ma: Bob(fc,u) 



Bob(fc,u) 
Charlie (fc,u) 
Alice(fc,u) 



Charlie 



(prio 100) 
(prio 50) 
(prio 80) 



Figure 2: Example trust mappings between arche- 
ologists Alice, Bob and Charlie. 



ever, this is difficult to achieve even if one keeps the lin- 
eage of each value. The problem is that Alice and Bob trust 
each other with highest priority: Alice keeps her jar value 
because of Bob' value jar; Bob keeps his value because of 
Alice's value. 

In this paper we propose an efficient and principled so- 
lution to the conflict resolution problem: given a network 
of priority trust mappings, find the values that are believed 
(and trusted) by each user. Our first contribution is a def- 
inition of conflict resolution based on a stable solution. A 
stable solution is simply a global assignment of values to 
users such that all trust mappings are satisfied, and that 
each value has a lineage to a value that was inserted explic- 
itly by some user. We show that stable solutions correspond 
precisely to the stable models of logic programs with nega- 
tion. However, computing stable models is notoriously hard: 
even if each rule of the program has a single predicate which 
is negated, deciding if a stable model exists for a given logic 
program is NP-hard [4| pp. 396] . We show that off-the-shelf 
logic program solvers scale exponentially when applied to 
confiict resolution. Instead, we describe a new, efiicient al- 
gorithm that runs in quadratic time in the number of trust 
mappings, and computes for each user both the possible val- 
ues and the certain values. To the best of our knowledge, 
this is the first solution to the conflict resolution problem 
that is both principled and efficient. We describe further 
extensions to answer queries about the conflicts themselves, 
such as finding pairs of users that disagree in at least one 
stable solution, or finding the lineage of a belief. 

Secondly, we study the impact of constraints on the con- 
flict resolution problem. Attribute-value constraints are de- 
fined by users, and can be, for example, a range-constraint 
for a numerical attribute, or an inclusion constraint (check- 
ing that the value appears in a reference database) for a 
categorical attribute. Once a user defines a constraint, the 
effect is that she rejects all values that do not satisfy the 
constraint, hence we also refer to a constraint as a set of 
negative beliefs. 

The simplest way to handle constraints is to restrict their 
usage locally: the constraint is only used to decide whether 
to accept or reject a value coming from another trusted user, 
and the constraint itself is not further propagated to other 
users. Only the data values are propagated. We call this the 
agnostic paradigm. Another reasonable approach is to treat 
constraints and data values equally and to propagate them 
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Figure 3: Recently proposed systems that model 
conflicts or data sharing for a community of users. 



together, based on the prioritized trust mappings. Thus, if 
Alice trusts Bob, then she also trusts Bob's constraints, and 
therefore may reject a value from Charlie if that value vio- 
lates Bob's constraint. We call this paradigm eclectic. Sur- 
prisingly, we show that both the agnostic and the eclectic 
paradigms are computationally hard: computing the pos- 
sible values is NP-hard, and computing the certain values 
is co-NP hard. Therefore, we propose a third paradigm of 
dealing with constraints, called skeptic. Here constraints 
continue to be propagated, but, in addition, each data value 
V is augmented with a constraint that rejects all other data 
values except v. When v is accepted, the constraint is re- 
dundant, but its role becomes important later downstream, 
if V is rejected (e.g. because of some other user's constraint). 
We show that the skeptic paradigm to conflict resolution can 
be computed efficiently (in quadratic time in the number of 
trust mappings). Thus, we propose the skeptic paradigm as 
our solution to handle constraints during conflict resolution. 

Finally, we study bulk conflict resolution, when similar 
trust relationships are applied to a large number of data 
objects. Here, the complexity is dominated by a large num- 
ber of objects, while the number of users is assumed to be 
small. We show that by simple changes to our two algo- 
rithms (without and with constraints) we can translate the 
trust mappings into SQL and execute them in a standard 
relational database. 

In summary, our contributions with this paper are; 

• We define a principled solution to the conflict resolu- 
tion problem, called stable solution, and give an algo- 
rithm that runs in quadratic worst time ( [Sect. 2[ ). 

• We describe three paradigms for handling constraints 
in conflict resolution and prove that two are hard. 
For the third one, we give an algorithm that runs in 
quadratic worst time ( [Sect. 3[ ). 

• We discuss conflict resolution in bulk and describe a 
solution based on a translation into SQL ( [Sect. 4 1. 

• We conduct experiments that show that, while quadratic 
in the the worst case, our proposed solutions actually 
scale linearly in most cases ( [Sect. 5[ ). 



2. BASIC CONFLICT RESOLUTION 

In this section, we deflne our model for handling conflicts 
through priority trust mappings. We do not consider con- 
straints here, but discuss those later in |Sect. 3] 

The database consists of a collection of objects. We as- 
sume w.l.o.g. that each object is identifled by a key k and 
has a single attribute. We write {k, v) when the object with 
identifier k has attribute value v. Given an object, different 



users may have conflicting beliefs about the correct value of 
its attribute. Thus, the attribute may take one of several 
values vi,V2, . . . according to different users' beliefs. We de- 
note D the set of possible data values, and U the set of users. 
Thus, user x G U may believe that {k,v) is correct, user y 
may believe (k, w) is correct, where v,w £ D, while user z 
may have no opinion about the value of the object k. 

Users' beliefs may differ from object to object. In this 
and the following section, we treat each object separately 
and therefore omit mentioning k altogether. In |Sect. "4] we 
discuss how to efficiently handle multiple objects. 

Thus, a user either has an explicit belief about the value 
of the object, or can derive her belief implicitly through 
priority trust mappings. We define these notions formally. 

Definition 2.1 (Explicit Belief bo). An explicit be- 
lief is a partial function from users to values withbo{x) being 
the value believed by user x. 

Definition 2.2 (Priority Trust Mapping m). Apri- 
ority trust mapping (or trust mapping, m short) is a triple 
m= {z,p,x), where z,x are users and p is an integer. The 
meaning is that user x trusts the value from user z with 
priority p. We call z a parent of x, and x a child of z. 

Definition 2.3 (Priority Trust Network TN). A 
Priority Trust Network (or trust network, in short) is a la- 
beled graph TN — {U,E,bo), where U is a set of users, E is 
a set of priority trust mappings, and bo is an explicit belief. 

Given a TN, each user x computes her belief b{x) as fol- 
lows: If x has an explicit belief bo{x) then this is also her 
belief. Otherwise, x computes her belief implicitly by choos- 
ing a trust mapping {z,p, x) with highest priority (i.e. largest 
p with ties broken arbitrarily), such that the parent z has 
some belief, and defines b{x) = b{z). Thus, the explicit beliefs 
stated by some of the users propagate through the graph to 
other users. If a user has two trusted parents with different 
beliefs, then the conflict is resolved according to the priority, 
with ties broken arbitrarily. 

Definition 2.4 (Stable solution b). A stable solution 
of a trust network {U, E, bo) is a partial function b from users 
to values, so that for every user x with b defined, there exists 
a path xo xi ^ . . . ^ x„ — x, s.t.: 

(1) xo has an explicit belief bo{xo) , 

(2) all nodes along the path have the same implicit belief 
b{xi) — bo{xo) , and 

(3) at no node Xi there is a trust mapping {x'i_i,p' ,Xi) 
with higher priority p' > p than (xi-i,p, Xi) and with 
a conflicting belief b{xi_i) 7^ b{xi) at parent x\_x. 

In this case, we call the sequence xo, . . . ,Xn the lineage of the 
belief b{x). In other words, every belief b{x) can be traced to 
some explicit belief along paths that are not dominated with 
conflicting values. b{x) remains undefined only if no parent 
of X has a belief and x has no explicit belief either. 

Resolving a trust network can be thought of as a con- 
flict resolution process: users that have explicit and distinct 
beliefs conflict with each other, and users without explicit 
beliefs decide whom to trust based on the priority trust map- 
pings. We illustrate with two examples: 



Example 2.5 (Simple TN). Fig. 4a shows a simple net- 
work that has a single stable solution: b{xi)=v (and b{x2) = 
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bo{x2) = v bo{x3)=w 
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(a) Simple TN 
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(b) Oscillator TN 



Figure 4: Two example trust networks with either 
one (a) or two (b) stable solutions. 



V, b{x:j) = w). Consider now Fig. 2 and assume the sin- 
gle explicit belief ba{Charlie) — jar. Then the unique so- 
lution IS b{Alice) = b{Bob) = jar. On the other hand, if 
both Charlie and Bob have explicit beliefs bo{Charlie) — jar, 
bo{Bob) — cow, then the unique solution is b{Alice) — cow. 

Example 2.6 (Oscillator TN). Now consider the trust 
network in \Fig. 4b\ It has two stable solutions, one with 
b{xi) = b{x2) = V, the other with b{xi) = b{x2) =w. To see 
that the first is a stable solution, note that xi and X2 de- 
rive their beliefs from X2 and xi respectively (cyclic), and 
both have a lineage that can be traced back to 60(2^3)- On the 
other hand, setting b{xi) — b{x2) — u, where u is an arbi- 
trary value, is not a stable solution, because u doesn't have 
a lineage to an explicit belief. 

The last example illustrates an important issue in solving 
a trust network: if the network has cycles, then there can 
be more than one stable solution, even if for each node, the 
trust mappings impose a total order on its parents. Cycles 
in trust mappings occur naturally since mappings are de- 
fined by individual users, and those often form groups that 
mutually trust each other more than others. Therefore, a 
conflict resolution system must cope with cycles, and this is 
a difficult problem as we have seen in [Example 1.2| 

2.1 Problem Statements 

We define a principled approach to conflict resolutions in 
terms of certain beliefs. For technical purposes, we define 
them together with their duals, the possible beliefs: 

Definition 2.7 (Certain / Possible Belief). Let x 
be a user and v be a value. We say that v is a certain belief 
if for every stable solution b, b{x) =v. We say that v is a 
possible belief if there exists a stable solution b s.t. b{x)—v. 

The main problem that we study in this paper is for each 
user X, find their certain beliefs, denoted cert(x). We call 
it resolving a trust network. For a simple illustration, the 
certain beliefs in |Example 2.6| are: cert(a::i) cert(j:2)=u, 
cert(a;3) — cert(2;4) — 0. Each user's certain belief represent 
a snapshot of the confiicting information in the network. If 
the network has a unique stable solution b, then each user x 
with at least one parent with a belief, also has a well defined 
certain belief, and cert(j:) = b{x); if there is more than one 
solution, then for some of those users cert(a::) = 0. 

In addition, we show that our techniques can be extended 
to solve several other related problems, such as: 

• Agreement checking: Find pairs of users x, y who agree 
in all stable solutions b: b{x) — b{y). 

• Consensus value: Given two users x, y, find all values v 
such that in every stable solution b, b{x)=v iS b(y) — v. 



• Lineage computation: Given a user x and possible 
value v for x, compute a lineage for v. 

2.2 Binary Trust Networks 

A Binary Trust Network (BTN) is a TN where every node 
X has at most two incoming edges and the explicit beliefs 
bo{x) are defined only for root nodes x (nodes without par- 
ents but with explicit beliefs) . We further assume that every 
node in a BTN is reachable by a path from some root node. 
If X is not reachable, then b{x) is undefined in any stable 
solution and may be safely removed from the BTN. The 
networks in |Fig. 2] and [Fig. 4| are binary. 

If X has a single parent zi , or two parents zi , 22 with pri- 
orities pi > P2, then zi is called preferred parent. Otherwise, 
it is called a non-preferred parent. Note that if there are two 
parents with the same priority, they are both non-preferred. 

Proposition 2.8. (Binary Trust Network Equiva- 
lence) Every trust network TN is equivalent to a binary 
trust network BTN of maximum double size, where size is 
the number of trust mappings. 



We prove [Proposition 2.8| in the appendix and from now 
on, and w.l.o.g., consider only binary trust networks. 

2.3 Logic Programming and Stable Models 

One possible approach to solve a trust network is to use 
Logic Programming (LP). Techniques for LP have been stud- 
ied extensively in the literature [4| and there are tools for 
LP solving. In this section, we explore the applicability of 
LP to solving a trust network. We associate the following 
LP to a BTN. There is a unary predicate Ux for each user 
X, and a unary predicate Cx,z for every non-preferred edge 
z X. If X has an explicit belief v, then Ux is an EDB 
predicate, satisfying the single predicate Uxiv); otherwise it 
is an IDB predicate. All Cx,z predicates are IDB predicates. 
The rules in LP are the following. For every preferred edge 
y ^ X we have rule (1) below, and for every non-preferred 
edge 2; — >■ a; we have rules (2a), (2b) below: 

Ux{r) ^ Uy{r) (1) 
Cx,.{s)^Uz{s),Ux(r),r^s (2a) 
Ux{s)^Uz{s),^Cx,.{s) (26) 

The first rule says that x should believe everything that its 
preferred parent y does. The second and third rules state 
that X should believe z, except when it conflicts with its 
own belief (presumably obtained from the preferred parent, 
or from the other non-preferred parent). The intermediate 
predicate Cx,z is introduced for technical reasons, to guar- 
antee safety of the resulting LP. 

The semantics of a LP is given in terms of a stable model. 
We briefly review the definition and refer to [4! for details. 
Consider the grounded logic program P, obtained by ground- 
ing each rule with all values in the active domain: each rule 
in the grounded LP has some positive and some negative 
predicates (In the case of BTN's, there is at most one neg- 
ative predicate). Consider a model M. The reduct of P by 
M is the logic program P*^ obtained by (a) removing all 
rules P where some negative predicate is false in M, and (b) 
removing all negative predicates from the remaining rules. 
Note that the reduct has no negations. The model M is 
called a stable model if it is the minimal fixpoint model of 
the reduct P^' . A ground fact is called certain if it belongs 
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Algorithm 1: Resolution Algorithm 



Size of the network [x- 1 U | + 1 E | ] 



Figure 5: Resolving a trust network with LP solvers 
is exponential in the size of the network. 



to all stable models; it is called possible if it belongs to some 
stable model. We prove the following in [Appendix B[ 

Theorem 2.9 (Logic Program Equivalence). Every 
stable solution to a BTN is a stable model to the associated 
LP, and vice versa. 



Input: BTN= {U,E,bo) 

Output: poss(x) for each node x & U 

I closed -f- 
foreach node x with bo{x) defined do 
poss(x) ^ {bo{x)} 
add X to closed 

open <— f/ — closed 
M while open ^ do 

51 if 3 preferred edge z x with z £ closed A x £ open then 
poss(a::) <— poss(2) 
move x from open to closed 

52 else 

Let 5CC(open) be the SCC graph constructed from the 
open nodes. Let 5 be a minimal SCC. Let possS <— 0. 
foreach edge z —> x with z £ closed A x S do 
^add all values from poss(2) to possS 

foreach z £ 5 do 
^poss(x) <— possS 

move all nodes of S from open to closed 



Example 2.10 (Oscillator). The LP corresponding to 
the oscillator from \Example 2.6[ is: 

Uiir)^U2{r) U2{r)^U4r) 
Ci,3(s)^(73(s), (7i (r),r/s C2A{s)^Uiis),U2ir),r^s 
Ui{s) ^ Uais), -Ci,3(s) U2{s) ^ Uiis), -.C2a{s) 

It has two stable models, Mi = {Ui{'v'),U2{'v'),U3{'v'), 
Uii'w')}, and Ma = {Ui{'w'),U2{'w'), U3{'v'),U4{'w')}. 

In summary, one can resolve a trust network as follows. 
Rewrite the BTN into a logic program, then use a LP solver 
to compute the certain tuples. Unfortunately, solving logic 
programs is hard, even in the most restricted settings. De- 
ciding whether a logic program has at least one stable model 
is coNP-hard even if all rules have a single atom in the body 
and that atom is negated; deciding if a ground tuple is a 
certain tuple is coNP-hard [Tsj. These theoretical results 
translate into running times that increase exponentially in 
the size of the BTN. [Figure 5| shows the running time of the 
state-of-the-art LP-solver DLV |l2] on increasingly larger 
BTNs composed of several oscillators from |Fig. 4b[ One can 
see the clear exponential trend: the LP solver becomes im- 
practical on graphs larger than 150 nodes. (We report more 
extensive experiments in |Sect. 5] ) Thus, relying on a general 
purpose LP solver is not a practical solution. Instead, we 
describe in the next section a new algorithm for resolving a 
trust network which runs in quadratic time of its size. 

2.4 An Algorithm for Conflict Resolution 

[Algorithm l| takes as input a BTN and computes the set of 
possible values poss(a;) for every node x. The sets of certain 
values cert(a::) can then be derived using the following rules: 
cert(a::) = {a} if poss(a;) = {a}, and cert(a;) = otherwise. 

The algorithm maintains a set closed of all nodes x for 
which poss(a;) is already computed. This set is initialized 
with all root nodes, i.e. all nodes with explicit beliefs Jl I. 
open contains all other nodes. During the main loop JMi, 
the algorithm performs two steps: Step 1 (SI I propagates 
greedily poss(a;) along preferred edges, closing the destina- 



tion nodes. Step 2 ( |S2[ ) handles the case when no more 
preferred edges can be traversed, and we describe it next: 

A strongly connected component (SCC) in a graph is a set 
S of nodes so that there exists a path from x to y and a path 
from y to x, for every two nodes x,y £ S. The SCC graph is 
formed by contracting the vertices of each SCC. It is known 
that this graph is acyclic and can be calculated in 0{n) 
time using Tarjan's algorithm [Ts]. In the second step ( [S2[ ), 
the algorithm computes the SCC graph of open nodes, and 
chooses a component S that is minimal in the SCC graph. 
In other words, S is an SCC that has no incoming edges 
from other SCCs. S may still have incoming edges, but 
they are all coming from closed, and moreover, they are all 
non-preferred edges. The algorithm defines poss(a;), for all 
nodes in S as the union of all possible values of all parents 
of nodes in S. It then closes all nodes in S. 

Examp le 2.11 (Osc illator). We illustrate the algo- 
rithm for Example 2.6 Initially, closed = {0:3,0:4}, and 
poss(a::3) — {v\ , poss(x4) = {w} . There are no preferred edges 
that can be traversed, so the algorithm proceeds with the 
second step, computing the connected components of open. 
There is a single component, {2:1, 2:2}, and their possible 
values are set to poss(a;3) U poss(a;4) = {v,w}. The out- 
put of the algorithm is: cert(x3) = {u}, cert(2:4) = {w}, and 
cert(a;i) = cert(a:4) =0. 

Theorem 2.12 (Resol ution Algor ithm). Letn bethe 
number of nodes in a BTN. Algorithm 1 runs in time 0{n^) 



and correctly computes the set of possible tuples for all nodes 
X m BTN. 

The running time follows from the fact that the SCC 
graph can be computed in time 0{n). Note that the runnig 
time is not 0{n), as the SCCs may need to be re-calculated 
at each iteration as the set open changes at each iteration: we 
show in the technical report that the algorithm takes f2(n^) 
in the worst case. We prove correctness in [Appendix A[ 

2.5 Discussion and Extensions 

Let's step back and examine what we have achieved. We 
have fixed an object k, and considered a priority trust net- 
work. Our goal is to give each user a snapshot of the data 
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that is consistent with the entire network. IDefinition 2.4l de- 
fines a stable solution for this network, but in general there 
may be several stable solutions. We have proposed the cer- 
tain values as the snapshot to be shown to the user, and 
described |Algorithm 1| which computes the certain values 
(and the possible values too) in time quadratic in the num- 
ber of users. The algorithm may need to be run separately 
for each object k, an issue that we will address in [Sect. 4] 

The important property of our approach is that both the 
definition and the algorithm are order-invariant: they do 
not rely on any order in which conflicts are to be resolved. 
The result is a consistent snapshot of the conflicting infor- 
mation. By contrast, as we have seen, prior approaches to 
conflict resolution process the explicit beliefs in a fixed order 
(e.g. in the order of their transaction time), and the result 
depends on this order. As a consequence, if any explicit be- 
lief is updated, e.g. some belief is revoked, there may be no 
way to re-compute a consistent snapshot. In our approach, 
if an explicit belief is updated, we will simply re-run the 
algorithm and obtain another consistent snapshot. 

As a further benefit of a principled approach, we men- 
tion here two extensions of our algorithm that allow the 
system to answer more complex queries, as those mentioned 
in lSect. 2.11 

Retrieving lineage. We show how to extend the algorithm 
to compute the lineage of each possible value. Whenever 
we insert a value v into poss{x), store a pointer back to 
the value v £ poss{z) that produced this possible value at 
x: for Step 1 this is a value in the preferred parent, for 
Step 2 there can be several (user, value) pairs from outside 
the set S: store pointers to all of them. Thus, from each 
value V G poaa(x) we can trace back several lineages. Note 
that this method is not complete: Step f misses some lin- 
eages that come to x via non-preferred edges. Ifowever, it 
has the property that each possible value has at least one 
lineage that the system can return to the user. 

Pairs of possible values. For any two users x,y m & bi- 
nary trust network, denote: 

poss(a;, y) = {(w, ui) j 3 stable solution b: b{x)=v,b{y)=w} 

Thus, poss(a;, y) denotes the set of pairs of values that x 
and y can take together. Note that if (u, w) G poss{x, y) 
then X £ poss(a;) and y g poss( y), but the converse is not 
true. For example in Fig. 4b[ poss(a;i, 2:2) contains the 



pairs (v,v) and {w,w), but not {VjW) or (»,«). 



Proposition 2.13 (Possible Pairs). \Algorithrn 



can be extended to compute poss(x, y) for all pairs of users 
x,y. The modified algorithm runs m time 0(n'^) where n 
is the number of users. 

The sets poss(a;, y) allow us to go beyond the snapshot con- 
sisting of certain tuples, and answer more complex queries 
about the conflicts and the reconciliation. For example, 
the agreement checking query mentioned in [Sect. 2.1] can 
be answered as {{x,y) \ W{v,w) £ poss{x,y) ^ v — w}. 

3. CONFLICT RESOLUTION WITH CON- 
STRAINTS 

In this section, we extend our approach to constraints 
which we model as negative beliefs. So far, we have only 



considered positive beliefs, i.e. a user either believes that 
the value of an object is v or has no opinion at all. A neg- 
ative belief, in contrast, states that the value of the object 
is not V. We denote with (fc, 1;)+ a positive belief, and with 
{k,v)— a negative belief. 

Constraints occur naturally in collaborative systems and 
enable users to filter the data values they accept. For ex- 
ample, one users may define the constraint the value of the 
'carbon-date' attribute is between 1,200 and 40,000: this cor- 
responds to a negative belief for every value v outside the 
range. Or, another user may rely on a reference database 
before accepting a value, e.g. the value of the 'translation 
attribute' must be in the 'list- of -known-words'. These con- 
straints are used to refuse a value from a trusted user and 
therefore affect the global conflict reconciliation. In addi- 
tion, a user may state a negative belief explicitly in order 
to refute another user's statement. For example, user Alice 
may state that the origin of TJ is cow, written (fci,cow)-f. 
User Bob may disagree. He does not know what the origin 
of the glyph is, but believes it cannot be a cow. His belief 
is thus (A;i,cow) — . Bob may accept other values, such as 
horse or jar, from users he trusts, but not cow. 

As in the previous section, our discussion focuses on a 
single, fixed object k and we will not mention k anymore. 
We write a positive belief as v-\- and a negative belief as v—, 
where v is a data value. An explicit belief can be positive 
v-\-, meaning that the user knows that the value is v, or can 
be a set of negative beliefs v—,w—, . . .. We allow these sets 
to be infinite as long as they can be finitely represented, for 
example by a range predicate. 

Definition 3.1 (consistency). Two beliefs bi,b2 are 
conflicting (&i-0-b2) if they are either distinct positive beliefs 
v-\~, 111+, or one is v+ and the other is v—. Otherwise, 61, 62 
are consistent (6i<->62)- A set of beliefs B is called consistent 
if any two beliefs 61 , 62 G B are consistent. 

Definition 3.2 (preferred union). Given two consis- 
tent sets of beliefs B\,B2, their preferred union is: 

B1QB2 = Bi U {b2 I 62 e B2.(Vfei G Bi.bi-^b2)} 

As in the previous section, our goal is to define, then com- 
pute all implicit beliefs based on the priority trust mappings. 
As we will see next, this raises both conceptual and compu- 
tational challenges. 

3.1 Three Paradigms 

Consider the binary trust network in |Fig. 6a| User xi 
defines a constraint resulting in a negative belief b—. Let's 
examine user x^ : she obviously adopts the explicit belief a-\- 
from her preferred parent X2. The question is: what should 
she do with the negative belief 6—? Should her belief be 
{a+, b—}, or just {a-|-}? Clearly, once she believes the value 
a+, she has no more use for the constraint b—, since the 
purpose of the constraint was only to rule out b-\- which is 
not under consideration at all here. This argument shows 
that she may well restrict her belief to {ffl-l-}. On the other 
hand, her decision may affect the users who trust her. Her 
immediate successor x^ will reject a-\-, but the next user x-j- 
has the option of adopting b+ or not. The decision made 
by user xg affects whether X7 can learn or not about the 
constraint b— defined upstream. As this example shows, 
there are several choices in defining conflict-resolution in the 
presence of negative beliefs, even for graphs without cycles. 



6 




(a) Explicit beliefs 



{«+} 


{b-} 






{'^-} \ 






P {"+} 






% / 


{&+} 




/ 2^6 



{a-} 

{b+} 

Eg {&+} 

(b) Agnostic paradigm 




X9{c+,a-,b-} 
(c) Eclectic paradigm 




(d) Skeptic paradigm 



Figure 6: (a): An example binary trust network with explicit positive and negative beliefs. The edge from the 
preferred parent is labeled as such, (b-d): The three alternative paradigms lead to different entailed implicit 
beliefs at various nodes for the unique stable solution of the trust network. 



We propose here three paradigms for trust network res- 
olution in the presence of negative beliefs. A paradigm is 
formally defined as a set of consistent sets of beliefs that are 
considered valid or in normal form. We denote _L = {v— \ 
V £ D} the set of all negative beliefs. Equivalently, _L is an 
inconsistent constraint that rejects any value. 

Agnostic. The only valid belief sets in this paradigm are 
singleton positives {v+} and sets of negatives {v—, w—, . . .}. 
Once a user knows the value of an object, they do not want 
to know any constraints, even if they are consistent with 
this value. In the agnostic solution, the negative belief b— 
is blocked by X3 who believes only a+ \Fig. 6b[ |. 
"An agnostic is a person who believes that nothing is known 
or can be known (. ■ . ) beyond material phenomena. " 

Eclectic. Any consistent set of beliefs is valid. In this 
paradigm, a user adopts all constraints that are consis- 
tent with a given value. Thus, {a-\-,b—,c—} is a a valid 
set of beliefs. The eclectic solution is shown in |Fig. 6c| 
Here 2:3 accepts the constraint b— in addition to a+. As a 
consequence, this constraint is communicated all the way 
to xy, who now rejects 6-I-. 

"An eclectic is a person who derives ideas, style, or taste 
from a broad and diverse range of sources. " 

Skeptic. The valid sets of beliefs are the following: all sets 
with only negative beliefs, and all sets that contain exactly 
one positive belief and all negative beliefs consistent with 
it, i.e. they are of the form {v+} U (_L — {v—}). Thus, 
when a user accepts a positive belief v+, she also adopts 
a constraint that rules out all other values. The skeptic 
solution is shown in |Fig. 6d\ In this paradigm the belief 
a+ "means" the set {a+, b—, c~,d—, . . .}. When X5 rejects 
a+, his belief becomes _L. This propagates to X7, who 
reject 6-I-, similarly to the eclectic paradigm. However, at 
the next step xg rejects c+ too, hence xg does not belief 
any positive value (he believes _L). This differs from the 
eclectic paradigm, where xg believes c+. 
"A skeptic is a person inclined to question or doubt all 
accepted opinions. " 

The paradigm is chosen by the system administrator and 
applied to all users. The stable solutions to a trust network 



depend on the paradigm chosen. Before we can define the 
stable solutions, we need some technical definitions. Let B 
be a consistent set of positive and/or negative beliefs. For 
each paradigm a £ {Agnostic, Eclectic, Skeptic} (abbre- 
viated by {A, E, S}), the normal form Normc{B) is: 

Norm,{B) = l otherwise 



NormsiB) = B 
Norms{B) = 



{v+}u{±-{v-}) 
B 



if 3v+ e B 
otherwise 



The preferred union specialized to the paradigm a is: 

BiU„B2 = Norm„ {Norm^{Bi)uNorm„{B2)) (1) 

For example: 

{a-}U,{b+} = {b+} 

{a-}UE{b+} = {b+,a-} 

{a-} Us {b+} = {b+, a-, c-, d-,...} 

{b-}Us{b+} ^ ± 

We define next a stable solution for a binary trust network 
with constraints. We make the restriction that edges enter- 
ing the same node have distinct priorities, thus we disallow 
ties. We discuss ties in [Appendix B[ 

Definition 3.3 (Stable solution w/ constraints). 
Let a G {A, E, S}, and let BTN = {U, E, Bo) be a binary trust 
network, where for all x, Bo{x) is either a positive belief, or 
a set of negative beliefs, or the empty set. A stable solution 
is a function B from users to sets of beliefs such that: 

(1) Ifx has a preferred parent y and a non-preferred parent 
z, then B{x) — Bo{x)Ucr{B{y)UcTB{z)Y Ifx has only 
one parent y, then B{x) = BQ{x)(JcrB{y) . Ifx has no 
parent, then B{x) = Norma (^Bo{x)) . 

(2) For every belief b G B{x) there exists a path xq — > 
xi x„ = X such that b G Normcr{Bo{xo)) and 
b G B(xi) for all i = 0, . . . ,n. 

Consider a node x and a positive belief v+. We say that 
v+ is possible if there exists a stable solution B s.t. v-\- G 
B{x). We say that is certain, if v-\- G b{x) for all stable 
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{a-} {a+/b+} {c-} {c+/d+} {c-} {c+/d+} {c-} {c+/d+} {a+} {b+} {a+} {b+} {a+} {b+} 




{d+{a-. fe-)/c+(a-, b-]} {e+(c-)/d+{c-)} {e+{a-,b-.c-, d-) / f +{a- ,b-, c-,d-)} 

(a)y = NOT(X) (b) y = OR(Xi,X2,X3) (c) SAT encoding of (Xi V ^Xa) A (Xa V Xs) 



Figure 7: (a,b): Representation of NOT and OR gates for Agnostic and Eclectic paradigms. A PASS- 
THROUGH gate is similar to a NOT, an AND gate to an OR. (c): A full example of CNF. Notice that 0/1 
are encoded differently at different levels: the inputs at the top are a/b for 0/1, the output at Z is e// for 0/1. 



solutions B. Our goal is to compute the possible and the 
certain positive beliefs under each of the three paradigms. 

3.2 The Complexities 

We show next that the Agnostic and Eclectic paradigms 
are hard, whereas Skeptic is in PTIME. 

Theorem 3.4 (Agnostic / Eclectic Complexities). 
Let a be Agnostic or Eclectic. Then the following hold: 
(a): Checking if a positive belief is possible at a given node 
X in a binary trust network is NP-complete. (b): Checking 
if a positive belief is certain at a given node x m a binary 
trust network is coNP- complete. 

Proof sketch. The proof is a quite simple reduction 
from the CNF SAT problem, and we include it here be- 
cause it highlights the inherent difficulties of coping with 
constraints in conflict resolution. The key technical step is 
that Boolean gates NOT, OR, and AND can be encoded as 
Trust Networks. Consider the NOT gate in |Fig. 7a| The 
inputs 0/1 are encoded as beliefs a+/&+, the outputs are 
encoded as c+/d+. When the input X is a+ for 0, then the 
output Y is d+ for 1. This is because a+ is blocked at the 
next level, hence d-f advances (the parentheses show the ad- 
ditional negative beliefs that are propagated in the Eclectic 
paradigm). Similarly, one can check that if X is b-\- for 1, 
the output Y is c-|- for 0. Thus, the network maps a-|-/&-f 
to d+/c+, hence it is a NOT. If we modify the network 
by switching c with d, we obtain a PASS-THROUGH gate 
which maps a-|-/6+ to c+/d-f . Next consider the ternary OR 
gate in [Fig. Tb] If at least one of the three inputs is d+ for 
1, d-\- will propagate to the output. If all inputs are c+ then 
all positive beliefs are blocked, and the output is e-f- for 0. 
Thus, the encoding of the output is e-\-/d-\- for 0/1. An AND 
gate is obtained similarly. By combining these gates, making 
sure that each level uses the same encoding of Boolean val- 
ues as positive beliefs, we can represent an CNF expression 
where the last level encodes 0/1 as e+/ f+. We further use 
basic oscillators, as in |Fig. 4b] to generate inputs 0/1. |Fig. 7c| 
illustrates the entire encoding of (Xi V ^Xa) A (X2 V X3). 
Notice the role of the PASS-THROUGH gates in ensuring 
that all values at the second level have the same encoding 
c-\-/d+. The reduction is completed by the observation that 
the CNF formula is satisfiable iff f+ £ poss(2), where Z 



is the output node. This proves the first claim of the theo- 
rem. The second claim follows from the fact that checking 
non-satisfiability of CNF formulas is coNP-hard, and that 
the formula is unsatisfiable iff e~\- £ cert(Z). □ 

Given this negative result, it is somewhat surprising that 
the third par adigm Skeptic can be computed in PTIME. 
Algorithm 2 runs in O(n^) and computes a set repPoss(a;) 
for each node x, which is a representation of the set of pos- 
sible values poss(x) at x as follows: If repPoss(a::) contains 
a positive value n-l-, then all other negative values are also 
possible, if repPoss(a;) contains _L, then all negative values 
are also possible. In summary, the set of possible values 
poss(a:) represented by R := repPoss(a;) is: 

poss(a;) = {v- | G R} U {w- | _L G R,w £ D} 

U {v+\v+ G R} U {w-\v+ eR,w e D,w^v} 

If repPoss(a::) does not contain a positive value or _L, we 
call it of Type 1. Otherwise, it is of Type 2. 

We describe now the algorithm, which is a natural ex- 
tension of |Algorithm 1[ The preprocessing phase ([P| finds 
all nodes who either have explicit negative beliefs or whose 
preferred ancestors have explicit negative beliefs. For that 
it starts from nodes x where the explicit belief has only neg- 
ative values, and continues with all nodes whose preferred 
parent has only negative beliefs. These nodes correspond 
to the empty nodes in the earlier [Algorithm 1| but unlike 
there, we cannot discard these nodes yet. The initialization 
phase (|l| again creates the sets of closed and open nodes, 
and closes nodes with explicit positive beliefs. Step 1 (SI I 
of the main loop ( |M| traverses all preferred edges z ^ x, 
and updates repPoss(a;) accordingly. Step 2 (S2| is slightly 
more involved and described next: 

Here the algorithm finds a minimal connected component 
S of open nodes (as before), but it cannot simply flood it 
with all positive values waiting to enter S. The reason is that 
some nodes in S can be reached from closed nodes through 
preferred edges. These are precisely the edges we skipped 
in Step 1. Thus, some nodes in the component S can be 
forced to accept negative beliefs, and these prevent a value 
u+ waiting to enter S to reach the entire set S. Instead, we 
simply compute which subset of S the value can reach, and 
add v-\- to the set of possible values for those nodes. For all 
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unreachable nodes, we add _L to the set of possible values, 
because in the Skeptic paradigm: {w— }Us{f +} = -L. 



Theore m 3.5. (Skeptic resolution algorithm) Al- 
gorithm 2 runs in time 0{n^) and computes the set of pos- 



sible values, for the Skeptic paradigm. 

3.3 Discussion 

This section described how to handle constraints during 
conflict resolution. We represent constraints as negative be- 
liefs and argue that they are an important feature in collab- 
orative data sharing. The question we have studied is how 
trust mappings should handle constraints. Perhaps the most 
natural approach is to use the constraints only as filters for 
data values accepted from other users, but otherwise ignore 
them during reconciliation. This is what we called the Ag- 
nostic paradigm. The second natural approach is to simply 
propagate constraints together with data values, in what we 
called the Eclectic paradigm. However, we have shown 
that computing the possible values under both paradigms is 
NP-hard (and computing the certain values is co-NP hard), 
so we do not advocate their use in data reconciliation. Our 
third paradigm is, we believe, natural too: propagate con- 
straints, but in addition associate to a data value a maxi- 
mal constraint, which rules out any other data value. This 
paradigm, we have shown, is in PTIME, and the algorithm is 
a natural, yet somewhat detailed extension of |Algorithm 1[ 
We propose the Skeptic paradigm as the basis for conflict 
resolution in cooperative data sharing systems. 

We note that, if no constraints exist in the system, then 
all three paradigms collapse to the simple semantics we dis- 
cussed in lSect. 2l 

The hardness of the Agnostic and Eclectic paradigms 
holds under the assumption that the network is cyclic: the 
proof used oscillators. If the network is a DAG, then all three 
paradigms can be computed in PTIME, by simply applying 
repeatedly the definition of preferred union ( |Eq. 

Proposition 3.6 (Acyclic BTNs). Let BTN he a bi- 
nary trust network that is acyclic. Then for any of the 
three paradigms (Agnostic, Eclectic, Skeptic) the follow- 
ing hold: (a) there exists exactly one stable solution, and (h) 
that solution can be computed m PTIME. 

A puzzling question is why is the Skeptic paradigm in 
PTIME, while the other two are hard. It is easy to see 
that the Boolean gates in |Fig. 7] no longer work under Skep- 
tic, but we do not consider this a satisfactory explanation. 
While we cannot give an ultimate cause, we point out one 
interesting difference. The preferred union for Skeptic is as- 
sociative, while it is not associative for either Agnostic nor 
Eclectic. For example, consider the two expressions B\ — 
{a-}Ua ({a+}Ua{&+}), B2 = {{a-}U„{a-\-}) U<,{b+}. For 
Agnostic, we have £2 = for Eclectic B2 = {a—,b+}, 

while for both Bi = {a—}. By contrast, one can show that Us 
is associative. Associativity as a desirable property during 
data merging was pointed out in 14 . 



4. EXTENSION TO BULK PROCESSING 

So far we have treated one object at a time. If several ob- 
jects need to be updated, then the reconciliation algorithm 
needs to be run separately for each object. In this section, 
we show, that under certain conditions, the set of possi- 
ble/certain values can be computed in bulk, for an entire 



Algorithm 2: Skeptic Resolution Algorithm 

Input: BTN= {U,E,bo) 
Output: repPoss(x) for each node x & U 

foreach x & U do prefNeg(2:) <— and repPoss(x) <— 
foreach node x with 3v— G bQ{x) do 
l^prefNeg(x) bQ(x) 

while 3 preferred edge z —¥ x with v— £ prefNeg(z), 
i)-f ^ bo{x) do 
|^prefNeg(a::) <— prefNeg(x') U prefNeg(2) 

closed 

foreach node x with v-\- £ bo{x) do 
repPoss(a;) <— bo{x) 
add X to closed 

open i— U — closed 
M while open ^ do 

51 if 3 preferred edge z x with z £ closed, x £ open and 
repPoss(x) = then 

repPoss(3::) <— repPoss(z) 
move X from open to closed 

52 else 

Let SCC(open) be the SCC graph constructed from the 
open nodes. Let S = {xi, . . . ,x„} be a minimal SCC. Let 
{zi, . . . , Zk} be all nodes in closed that have edges into S. 
forall i £ {1, . . . ,n}, J £ {1, . . . , fc} do 
foreach v+ £ repPoss(zj) do 

Let S' = S - {x \ V- e prefNeg(x)} 
if 3 path Zj — > Xi in S' then 

I repPoss(zi) <— repPoss(x'i) U {'«+} 
else 

l^repPoss(xi) •<— repPoss(a;i) U {-L} 

foreach v— £ repPoss(2j) do 
^repPoss(3::i) •<— repPoss(a;i) U {f — } 

move all nodes of S from open to closed 



set of objects ki,k2, . . . ,k„. We sketch here the approach 
and provide the details in [Appendix B| 

Let TNi , . . . , TNn be the trust networks for each of the n 
objects. We make the following two assumptions: 

(i) The set of trust mappings is the same for each object 
ki, i.e. a user x trusts a user z globally, for all objects. 

(ii) If a user has an explicit belief for an object ki, then 
the user has an explicit belief for each of the objects. 

Then it is possible to simply adapt both, [Algorithm 1| 
and I Algorithm 2] to bulk-compute the set of possible tuples 
through SQL queries. Let POSS(X,K,V) denote the a relation 
representing the possible values: an entry {x, k, v) means 
that « is a possible value for user x and object k. Then, in 
step 1 of the modified algorithm, when traversing a preferred 
edge z ^ x, we perform the following bulk insertion: 

insert into POSS 

select 'x' AS X, t.K, t.V 

from POSS t 

where t . X = ' z' 

In step 2, when 'flooding' a strongly connected component 
SCC with the beliefs coming from the users zi, . . . ,Zk we 
perform the following bulk insertions for each Xi £ SCC: 



insert into POSS 

select distinct ' 

from POSS t 

where t . X = ' 21 ' 



AS X, t.K, t.V 



t.X 



'Zk ' 
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(a) Network with many cycles (b) Network of sampled web links (c) Bulk inserts 

Figure 8: Experiments for various setups show quasi-linear scalability of our Resolution Algorithm (RA) in 
contrast to exponential scalability for solving the corresponding Logic Program with DLV. 



For |Algorithm 2| we need to modify some of the insert 
statements to insert the appropriate representation of _L 
rather than poss(a;). 

5. EXPERIMENTS 

We have conducted an experimental evaluation of our 
approach addressing the following questions: What is the 
observed runtime performance, both of the quadratic con- 
flict resolution algorithm (RA) and of the bulk-update algo- 
rithm? And how does our approach compare to computing 
the stable models using an advanced liner program solver? 
For the latter we used the programming system DLV [12| , 
which is widely considered the state-of-the-art implemen- 
tation of logic programming with negation, and execute it 
under the brave query semantics"^. All algorithms are imple- 
mented in Java and were run on a 2.2GHz dual core machine 
with 4GB of main memory. Execution times for RA are av- 
eraged over 20 trials. 

We used two data sets in our experiments. The first is a 
synthetic data set, consisting of a network of many indepen- 
dent cycles. This network consists of several, disconnected 
4-node clusters of the form from [Example 2^ In this net- 
work, one out of two users has an explicit belief. In our 
second data set, we modeled a trust network with as much 
expected real-life characteristics as possible. Real-world so- 
cial structures are known to exhibit a power-law behavior, 
often referred to as scale-free. We used a large crawl of a 
top level domain of the World Wide Web and the link struc- 
ture between sites which exhibits such behavior, with around 
270k domains with 5.4M links. We identified domains with 
users and links with trust mappings, and assigned random 
priorities. We varied the size of this database by randomly 
sampling a fraction of all edges and include both start and 
end point in our sampled graph. 

The results of our experiments are reported in |Fig. 8] For 
the synthetic data set, as shown before, DLV runs in expo- 
nential time (Fig. Sal. In contrast, RA runs in almost linear 
time: thus, just increasing the number of cycles does not 
lead to a quadratic running time of our algorithm. We omit 
running times on very small data sets, because they showed 
high variance due to factors unrelated to the algorithm (Java 



memory management, L2 cache behavior). Figure 8b shows 
our results on the real data set. DLV performs better on this 
data set, since it contains fewer cycles, on average. However, 
our algorithm is still faster by several orders of magnitude 

■^command: "div.bin -brave input.txt query.txt" 



and exhibits the same robust behavior as before. Overall, 
RA had an average running time of around 0.01 msec per 
user and trust relation on both data sets. 

We note that the running time of our algorithm ts quadratic 
in the worst case (we prove this in [Appendix B[ ), but the 
types of graphs that lead to quadratic behavior are complex 
and highly regular with nested cycles. We tested our algo- 
rithm on such kinds of graphs and measured running times 
of about 4 sec for a network size of 10,000. 

Finally, |Fig. 8c| shows our result for testing the bulk con- 
flict resolution algorithm from [Sect. 4[ We used a trust net- 
work with 7 users and 12 mappings, and assumed two users 
with explicit beliefs. Then we varied the number of objects 
in the database. For each object, we randomly chose these 
beliefs of the two users to be in conflict, or in agreement. 
Then we reconciled all users, on all objects. The database 
system was Microsoft SQL Server 2005, and we used JDBC 
for calls to the database. The data was stored in a rela- 
tion POSS(X,K,V), as described in [Sect. 4[ [Figure 8c] shows 
linear data scalability of our algorithm . The running time 
of DLV is exponential here too, because of the conflicts in 
half of the objects between the two users. In contrast, the 
running time of the bulk conflict resolution algorithm is in- 
dependent of the number of conflicts. 

6. RELATED WORK 

Several systems have been recently described that adopt 
some kind of conflict resolution or trust mapping to model 
data sharing in a community of users [7|[9][ll][l6|[l9]. These 
systems discuss techniques in the presence of various subsets 
of the features needed in conflict resolution ( [Fig. 3[ ). Con- 
flicts occur when the system allows key constraints; a conflict 
is simply a violation of the key constraint. Orchestra is the 
only system that considers both conflicts and priorities, and 
is closest in spirit to our setting. We share with Youtopia 
the use of certain/possible values, a concept originally intro- 
duced for incomplete databases [10) . 

Our solution has relevance to the research areas of data 
integration and data exchange. Similar to [l9], we assume a 
fixed schema in this paper. In contrast, work on peer data 
exchange focuses on arbitrary tuple and equality generat- 
ing dependencies between different database instances with 
varying schemas. However, it does not consider priorities 
amongst different mappings between peers and it is known 



*Data points below 100 msec seem to be dominated by the 
overhead of the Java-SQL server connection 
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that data complexity under this semantics is in coNP, and 
that it can be coNP-complete even for acyclic peer data 
exchange settings [s]. Those proposals whose semantics is 
tractable do not consider local integrity constraints (such as 
key violations) and hence do not model conflicts 11 . 

Using logic programs and stable models semantics as means 
to produce certain answers has been proposed before un- 
der the framework of consistent query answering (CQA) [T] . 
However, and as we have illustrated, this approach is gen- 
erally not tractable; no polynomial time case is known for 
universal constraints with negation P. Fig. 1]. As a conse- 
quence, previously proposed semantics that build on logic 
programming have coNP data complexity [5] and we are not 
aware of any proposed polynomial algorithm that deals with 
a principled solution to inconsistency resolution for key con- 
straints and trust mappings. 

7. CONCLUSIONS 

This paper presents a principled approach to the problem 
of conflict resolution in a community database where users 
trust other users with varying priorities. Our semantics has 
a number of intuitive and desired properties such as indepen- 
dence of the update sequence and, hence, correctly models 
revoke operations and avoids transient effects. We give a 
PTIME algorithm that has quadratic worst case scalability 
in the size of the network. In our experiments, we show that 
it is actually linear on typical network structures. We also 
expand our techniques to constraints, and show, depending 
on the approach taken, conflict resolution can be either in- 
tractable, or computable in time that is quadratic in the 
number of users. In addition, we show how this algorithm 
can be easily adapted to include bulk processing. 
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APPENDIX 
A. PROOFS 



Proof sketch of [Proposition 2^81 Let TN^ {U,E,bo). 
We construct the binary network BTNhj adding some addi- 
tional nodes to U , and re-defining the edges. First, for every 
node X £ U with an explicit belief v — bg {x) , we create a new 
node xo in BTN, define bo{xQ) = v, and make xq the highest 
priority parent of x: thus, x no longer has an explicit belief, 
but will get his belief from xq, which is a root node in BTN. 
Second, let {z\,pi,x), . . . , {zk ,pk,x) be all edges entering x, 
in increasing order of priority: pi < ■ ■ ■ < Pk- We create k—2 
new nodes 2/2, . . . , J/fc-i, and further denote t/i = zi, yk—x. 
We remove all edges entering x, and create edges (j/i-i, 1, yi) 
and {zi,p,yi) for i £ {2, . . . , fc}, where p = 2 ii pi > Pi-i, 
and p= 1 if pi =pi-i. Thus, every node yi, i £ {2, . . . k}, has 
two parents j/i^i and Zi, which are either both non-preferred 
(priorities 1, 1) or non-preferred and preferred (priorities 1, 
2). We prove the following in Appendix B (a) for every 
stable solution b of BTN its restriction to the nodes in TN 
is a stable solution for TN, and (b) every stable solution b 
of TN can be extended to a stable solution of BTN. □ 



Proof of ITheorem 2.121 We caU a set U' <^ U free if 
(a) U' contains all root nodes, and (b) every edge from a 
node in (7 — f/' to a node in U' is a non-preferred edge. The 
intuition is that a preferred edge forces the target node to 
accept the value of the source node: U' is free, if it is not 
forced to accept a value from U — U' . 

We show by induction that at each step of the algorithm, 
closed is free. Initially it contains only root nodes, hence it 
is free. Step 1 extends closed with a new node x by following 
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a preferred edge: since preferred edges are unique for every 
node, there are no other preferred edges into x, hence closed 
is still free. In Step 2, closed is extended with an entire set 
S: but all edges entering S are coming from closed (because 
we chose 5* to be minimal), it continues to be free after 
extension. Hence, closed is free at each step of the algorithm. 

Lemma A.l (Forward Lemma). Let U' be a free set of 
TN = {U,E,bo), and let E' be the set of edges where both 
endpoints are in U' . Let b' be a stable solution for the sub- 
graph {U' , E' ,bo) ■ Then b' can be extended to the entire 
graph TN . More precisely, there exists a stable solution b 
for TN such that for all x € U' , b{x) = b'{x). 

Proof sketch. We prove the statement by induction on 
the size of the set U — U' . When U' — U, then there is 
nothing to prove, since b' already applies to the entire graph, 
so suppose U' C U. Case 1: there exists a preferred edge 
from a node z G [/' to a node x G U — U' . Extend b' 
to X by defini ng b'{x) = b'{z); one can check directly from 
Definition 2.4 that this is a stable solution for U' U {x}, and 
thus we apply induction hypothesis to U' U {x}. Case 2: 
all edges from U' to U — U' are non-preferred. Let S be a 
minimal connected component oi U — U' , and let z ^ x be 
any edge^ from U' to S. Extend b to the entire set S by 
defining b{y) = b{z) forall y £ S; one can check that this 
is a conflict-resolution solution for U' U S; apply induction 
hypothesis to the set U' U S. □ 



As a simple illustration of the power of |Lemma A.l[ recall 
that there exists logic programs without any stable model ; 
by contrast, every BTN has at least one stable solution. This 
follows from the Forward Lemma by letting U' be the set of 
roots, and defining b'{x) = bo{x) for every root node x: the 
lemma ensures the existence of a stable solution. 

We now use the lemma to prove the correctness of the 
algorithm, by showing soundness and completeness. Sound- 
ness: We show by induction on the number of steps that 
any value v G poss(a::) is a possible value. Suppose the al- 
gorithm applies Step 1 to a preferred edge z ^ x and sets 
poss(a::) = poss(2). Let v £ poss(2:): by induction hypoth- 
esis there exists a stable solution b s.t. b{z) = v. Then 
b{x) — b{z), because the edge z ^ x is preferred. (We did 
not use the lemma at this step.) Suppose the algorithm ap- 
plies Step 2 to the SCC S, and let z — >■ a; be a non-preferred 
edge entering S, and let v £ poss(0). We will show that v 
is a possible value for all nodes in S. By induction hypoth- 
esis there exists a stable solution b s.t. b{z) — v. Define 
U' = closed U S: we have shown earlier that this is a free set. 
Define the stable solution b' on U' as follows: b' is equal to b 
on closed, and forall nodes y £ S, b' (y) = b[z) = v. One can 
check that b' is indeed a confiict resolution on the set U' by 
applying Definition 2.4 directly (here we use the fact that 
all preferred edges to nodes in S are coming only from S). 
Apply the Forward Lemma to argue that it can be extended 
to a conflict resolution solution on the entire graph: this 
proves that is a possible value for all nodes in S. Com- 
pleteness: We show by induction that for every node x and 
every stable solution 6, b{x) € poss(a;). If x enters closed 
after traversing a preferred edge, then the statement follows 
inductively from x's parent, so assume a; is in a SCC S, and 



let 6 be a stable solution. Traverse the lineage of b{x) back- 
wards, from x to a root node, and consider the first node 
z that is not in S. By induction hypothesis b{z) £ poss(2), 
which implies that b(x) = b{z) £ poss(a;) (since poss(a;) is 
the union of all such poss(z)). Note that the completeness 
proof also implies that, if poss(a::) is a singleton set, then its 
unique element is a certain value: cert(x) = poss(2;). 



Proof of IProposition 2.131 We assume the constraint 
{v, w) £ poss(x, y) <^ {w, v) £ poss(2/, x) is maintained au- 
tomatically, i.e. whenever we insert {v,w) in poss(a;,y), we 
also insert (w, v) into poss(?/, x). For each root node x we ini- 
tialize poss(a;,2;) = {{bo{x),bo{x))} . To compute poss{x,y), 
the algorithm needs to be modifled as follows. During Step 
1, when we follow a preferred edge z — >■ x, we set for all 
u £ closed: 

poss{u,x) — poss(u, 2) 

poss(2,a::) — {{v,v) \ v £ poss(2)} 

During Step 2, when we compute the set of possible values 
for an SCC 5, we do the following. Let 21 , . . . , 2^ be all nodes 
in closed that have an edge entering S, and let xi, . . . ,Xk be 
their endpoints in 5*. Then: 

poss(-u, s) — [J poss(u,2i), where u £ closed, a; £ S 

poss(2;,j/)= [J pOSs(2i,2j) 

i,j:3disjoint paXhs.Xi^x,xj^y in S' 

We explain these two formulas next. From the proof of 
[Theorem 2.12| we have seen that for every value v £ poss(2i) 
it is possible to flood the entire component S with 11. This 
proves the flrst line above: any pair of values possible for 
(u,2i) is also possible for {u,x). For the second line, we 
need to check if, given v £ poss(2i) and w £ poss(2j), it 
is possible to assign v to the node x and w to the node 
y. We proceed as follows. Let S' be obtained from 5* by 
collapsing all nodes that are connected via preferred edges. 
(In any stable solution, all collapsed nodes must have the 
same value). In the resulting graph, we check whether there 
exists two independent paths Xi ^ x and Xj — ^ y: this 
is solvable in PTIME using network-flow techniques [g] pp. 
217]; in particular, if x and y are connected by a path of 
preferred edges, then they are the same node in S' and there 
are no independent paths. If such a pairs of paths exists, 
then X, y can take simultaneously values v and w. To prove 
this, start with a stable solution b that has 6(21) = v and 
6(22) = w, and partition S' arbitrarily into two sets 81,82 
s.t. the first one contains the path Xi ^ x and the second 
one contains the path Xj — > y. All edges crossing between Si 
and 5*2 are non-preferred (since we have collapsed preferred 
edges): hence we can extend the stable solution & to S by 
assigning the value v to all nodes in Si and value w to all 
nodes in S2. This proves that the pair of values {v,w) is 
possible for the nodes x,y. □ 



Since each node in the graph is reachable from a root node, 
and all root nodes are in U' , such an edge always exists. 
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B. APPENDIX FOR TECHNICAL REPORT 
B.l Nomenclature 



k 
D 

{k,v) 

V, UI, u 

U 

X, y, z 

P 
m 



E 

bo 
b 

TN 
BTN 
r, s 
S 

poss(a::) 
cert(x) 
B 

a,... J 

U 



repPoss(a;) 



key representing an object 
domain, set of data values 
belief, key-value pair 

values £ D, beliefs if key is assumed fixed 
set of users 
users £ U 
priority 

priority trust mapping (z, p, x) with priority p as spec- 
ified by a user x from a parent z, arrows point from 
parent to node (z —> x) 
edges, set of priority trust mappings 
explicit beliefs, partial function bo : U —> D 
beliefs b : U —^D, corresponds to one stable solution 
a trust network [U, E, bo) 
a binary trust network {U' , E' , bo) 
variables used for values in Logic Programs (LPs) 
Strongly Connected Component (SCC) 
possible belief for x, brave stable model semantics 
certain belief for x, cautious stable model semantics 
sets of beliefs B : U ^ 2^ in section 3 
signed values in section 3 
Preferred Union between two sets of beliefs 
Paradigm c £ {Agnostic, Eclectic, Skeptic} 
also abbreviated by cr G {A, E, S} 
consistent beliefs 
inconsistent beliefs 

representation of poss(x) for Skeptic paradigm 
set of natural numbers from j to fc, {j, . . . , fc} 



B.2 Stable model semantics 

We give a short, self-contained review of logic program- 
ming and stable models and refer to [2] for details. 

A normal logic program ~ ' 
form 



P is a finite set of rules of the 



Ao ^ Lx,. ■ ■ ,Lrn (m > 0) 

where Ao is an atom and each Li is a positive or negative 
literal, i.e. either an atom Ai or a negated atom -^Ai. The 
Herhrand base Bp of a logic program P is the set of all 
ground atoms that can be formed with predicates and con- 
stants from P. An interpretation / of a logic program P is 
any subset / C Bp of its Herhrand base. A model of P is 
an interpretation such that for each rule Ao Li, . . . , Lm 
in P, this interpretation satisfies the logical formula ^(x) : 
(Z/i A ■ ■ • A Lm) Ao where x is a list of the variables in the 
rule. The ground instantiation of P, denoted by ground{P) 
is the union of all rules from P that can be obtained by 
replacing variables with constants from P in every possible 
way. 

A definite logic program P is a normal logic program that 
consists of only Horn clauses, i.e. rules where each of the lit- 
erals is positive. Each definite logic program has one unique 
least model . 

A normal logic program P is stratified if there is an as- 
signment str{-) of integers 0, 1, . . . to the predicates p in P 
so that for each rule r in P the following holds: If p is 
the predicate in the head of r and q the predicate in an Li 
from the body, then str{p) > str{q) if Li is positive, and 
str{p) > str{q) if Li is negative. 

The reduct P^ of a normal logic program P by an in- 
terpretation / is the set of ground clauses obtained from 
ground{P) as follows: 



(i) remove every clause r with a negative literal -^Ai in the 
body if its atom Ai £ /; 

(ii) then remove all negative literals from the remaining 
rules 

Notice that P^ is a definite logic program and has one 
least model. An interpretation / is a stable model of P 
if I is the least model of P^: I = T^i . Every stratified 
P has a unique stable model. Unstratified rules increase 
complexity and can have none, one or several stable models. 
Stratified propositional logic programming with negation is 
P-complete (equivalently, stratified Datalog with negation 
is data complete for P). Propositional logic programming 
with negation under SMS is co-NP-complete (equivalently, 
Datalog with negation under SMS is data complete for co- 
NP). And, given a propositional normal logic program P, 
deciding whether it has a stable model NP-complete. 

B.3 Binarization of trust networks 

Here we give the details for the binarization and the com- 
plete proof of [Prop. 2. 8| outlined in [Appendix A| 

Proof of [Proposition 2.8] (BTN Equivalence). Let 
TN — (U, E, 60) be a non-binary trust network. Consider a 
node X £ U with k > 2 parents z\, . . . ,Zk and construct a 
modified trust network TN = ([/',£', 60) with A: - 2 ad- 
ditional nodes 1/2, . . . , J/fc-i and some edges redefined as de- 
tailed in the transformation below, so that all a;, ^2, ... , J/fc-i 
have exactly 2 parents. Denote SG the induced subgraph 
over X, z-i, . . . , Zk of TN, and SG' the induced subgraph over 
X, 1/2, . . . , Vk-i, z\, . . . ,Zk of TN . We call SG' the binariza- 
tion of SG, and will show that binarization does not change 
the stable solutions for the original nodes of a trust network. 

Transformation. We first describe binarization: Let 
(zijpi, x), . . . , {zh,Pk,x) be all edges entering x in increas- 
ing order of priority pi < . . . < Pk- Create new nodes 
1/2, ... , yk-i, and further denote yi := z\ and yk ■= x. Re- 
move all edges entering x, and for each yi {i £ Nj"^) create 
two edges, each with either priority 2 (called preferred edge 
and depicted double-lined) or priority 1 (called non-preferred 
edge and depicted single-lined) as follows: 

(a) If pi = pi-i = Pi, then create (j/i-i, 1, y,) and {zi, l,yi) 
(see |Fig. 9a[ ). 

(b) If Pi 1 < Pi = pi+i, then create {zi, l,yi) and I 
(see [Fig. 9b I. 

(c) If pi < pi-i = pj_=_£i+i, then create (y,-i, 
{zi+i,l,yi) (see |Fig. 9c I. 

(d) If pi < pi_i = Pi < Pi+i, then create (yj-i, 1,2/0 s^^d 
(j/i_i, 2, j/i), where j is the minimum index for which 



Zi + l 



,yi. 



and 



Fig. 9dl 



Pj = Pi (see 

(e) If pi-i < Pi < pi+i, then create {yi-i,l,yi) and {zi, 2, yi) 



(see Fig. 9e I 
Node X 



but restricted to 



yk is treated just as another yi 
cases (a), (d), or (e), i.e. as if pfe < pk-\-i- 

The resulting subgraph SG' is a binary tree, shaped as a 
cascade, where every node y2, . ■ . ,yk has exactly two par- 
ents (which are either preferred and non-preferred, or both 
non-preferred). Parents Zj, . . . ,zi with the same priority in 
SG appear in a subtree whose root yi~i dominates the path 
from each parent with lower priority to x, but whose path 
to X in turn is dominated by every parent with higher prior- 
ity in the original SG (see Fig. 10c I . Consider, for example, 
node X with 7 parents zi, . . . , 27 with pi =P2 <P3 =P4 =P5 < 
P6 <P7 from |Fig. 10a[ Its binarization has additional nodes 
t/2, . . . , 1/6 and is shown in |Fig. lOb) Notice that 2:3, 24, Z5 
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(a) Pi =pi (b) <Pj =pi+i (c) pi<pi-i=pi=pi+i (d) pi <pi_i =pi <pi+i (e) pi-i <pi <pi+i 

Figure 9: Binarization: Each node yt with i G N2 has edges to two parents with either different priorites 
(preferred and non-preferred) or equal priorities (both non- preferred). 



Zl 



Z2 Z3 Z4 Z5 ze zi 

S\\\ ? f 

Pi P2 P3 Pi P5 P6 P7 




(a) Example SG for node x 




(b) Binarized SG' for node x 



Vj-i 




(c) <Pj = 



Figure 10: Binarization: nodes with several incoming edges are cascaded into steps of binary resolution 
with preference or without preference. Subgraph SG' in (b) is the binarization of SG in (a) assuming 
Pi =P2 <P3 = P4 ~ Ps <P6 <P7- Parentheses in (b) show which rules from Fig. 9 were applied, (c) Fragment of 
binarization for x's parents zj, . . . ,zi with equal priority: Pj~i <Pj = . . . =pi <pi+i. 



together with 1/3 , 1/4 form a subtree with root j/4 that dom- 
inates all paths from zi or 22 to x, but whose path to x is 
dominated by the paths from ze or zj to x. 

Actual proof. We next prove that (1) for every stable 
solution b' of TN" in which none of the nodes y2, ■ ■ ■ ,yk-i 
has an expHcit belief, its restriction to the nodes without 
j/2 , • • • , J/fc-i is a stable solution b for TN, and (2) every stable 
solution b of TN can be extended to a stable solution b' 
of TlSf by assigning appropriate beliefs from zi, . . . ,Zk to 
the additional nodes j/2,---,yfc-i in SG'. It follows that 
applying binarization for each of the original nodes with 
more than 2 parents in TN leads to a binary trust network 
BT'A'with exactly the same stable solutions over the original 
nodes in TN. 

(1) b' — >■ b: We distinguish three cases: 

(a) : If b'{x) is undefined in TN , then b' must be undefined 
as well for all 1/2, • • • , Vk-i, zi, . . . , Zk. Hence, b is undefined 
for all X, Zl, . . . , Zk in TN, which is a stable solution. 

(b) : If b'{x) = b'o{x) for TN' , then b{x) = bo{x) = b'^ix) 
for TN, which is a stable solution. 

(c) : If b' {x) is defined, but 69 is undefined for &\\ x,y2, . . . , 
yk-i, then the lineage of b'{x) must pass through at least 
one Zi- (i* G Nj) in TN. We show that keeping b{x) = b'{x) 
and b{zi) = b'{zi) for all i € Ni , but replacing the subgraph 
SG' in TN with SG, is a stable solution with the lineage 
of b{x) passing through the same Zi* in SG. We distinguish 
three subcases: 

(i): First, assume that Zi* is part of a subtree such as the 
one with leaf nodes Zj, . . . ,zi in |Fig. 10c] (i.e. that Zj, . . . , zi 
all have the same priority in the original SG). Then no node 
in {zi+i, . . . , Zk} can have a belief with conflicting value as 
their path to x would dominate that of Zi* to x. However, 
each node in {zi, . . . , 2;} \ {zi*} may have conflicting beliefs 
as their path to x cannot dominate the lineage of b'{x). This 
solution corresponds exactly to the lineage for b[x) in SG as 



each node in {zi+i, . . . , Zk} has a higher priority and each 
node in {21, . . . ,zi} \ {zi- } has a lower or equal priority. 

(ii): Second, assume that Zi* is part of a subtree without 
preferred edge s that in cludes 21 such as the one with leaf 
nodes 21, 22 in Fig. 10b (i.e. that {21, . . . , Zi* , . . . zi} all have 



the lowest priority in the original SG). Then no node in 
{zi+i, . . . , Zk} can have a conflicting belief as their path to 
X would dominate that of Zi* to x. This solution also holds 
for b{x) in SG. 

(iii): Third, assume that Zi* is connected to yi* with 
a preferred edge such as 2;+i 
{zi* +\, . . . , Zk} have higher priorities, and {21 



Fig. 10c (i.e. that nodes 



have lower priorities in the original SG). Then no node in 
{2i*+i, . . . ,Zk} can have a conflicting belief, but each node 
in {21, . . . , 2i»_i} can have. This solution also holds for b{x) 
in SG. 

(2) b ^ b': We again distinguish three cases: 

(a) : If b{x) is undeflned in TN, then b must be unde- 
fined as well for all 21, . . . , 2^. Hence, b' is undeflned for all 
X, y2, . . . , yk-i, Zl, . . . ,Zk in TN , which is a stable solution. 

(b) : If 6(a;) = bo{x) for TN, then b'{x) = b'o{x) = bo{x) for 
TN. Each of the new nodes 2/2, ■ . ■ , J/fc-i gets consecutively 
assigned one value from its two parents according the fol- 
lowing four simple rules: (i) if it has a preferred parent with 
a belief, it gets assigned this value; (ii) if it has two non- 
preferred parents with beliefs, it gets either of these values; 
(iii) if it has only one parent with a belief, it gets assigned 
this value; (iv) if it has no parent with a belief, it gets as- 
signed no value. Note that the new nodes y2, . . . ,yk-i are 
partially ordered, and consecutively assigning values to them 
with increasing index assures that the nodes are treated in 
this partial order (see lFig. 9[ ). It follows that the result- 
ing belief assignment 6 is a stable solution. Also note that 
while TN may have more total stable solutions for all vari- 
ables including 1/2, .. . , J/fc-i, the projection of these stable 



14 





original 
n-clique 


binarized 
network 


relative factor 
for lim„^oo 




\u\ 


n 


n(n- 2) 


n 




\E\ 


n(n — 1) 


2n(n - 2) 


2 


\E\ - 


F |;7| 




3n(n - 2) 


3 



2;i 



Z2 



Z3 



Figure 11: The maximal increase in size through 
binarization happens for an n-clique (n > 4), where 
number of edges increases by < 2 and number of 
edges plus nodes by < 3. 



solutions onto the variables appearing in TN, i.e. without 
j/2, . • . , yfc-i, is exactly the same stable solution b. 

(c): If b{x) is defined, but bo{x) is undefined, then the 
lineage of b{x) must pass through at least one Zi* (i* £ N*) 
in TN. We show that keeping b'{x) = b{x) and b'{zi) = 
b{zi) for all i £ Ni, while replacing the subgraph SG in 
TN with SG' and assigning appropriate values to all nodes 
j/2,...,yfc-i is a stable solution with the lineage of b'{x) 
passing through the same Zi* in SG' . This can be achieved 
as follows: Let yj* be the single node that Zi* is connected to 
in SG' (for example, this is 2/2 for both zi and Z2, and j/4 for 
Z5 in |Fig. 10b| . Then assign all nodes j/2, • • . , any belief 

according to the four simple rules given in (2b), and assign 
all nodes j/^*, . . . ,yk-i the same value b{x) in TN . This is 
a stable solution, since the path Zi* — > yj* —>...—>■ j/^ = a; 
cannot be dominated by any conflicting belief (other wise 
b{x) would not be a stable solution in TN). 

Bounds. We next give bounds for the increase in size 
of the network due to binarization. The induced subgraph 
SG for a node with k > 2 parents gets binarized into a 
network SG' with fc — 2 additional nodes. Hence, the number 
of edges in SG' is 2{k — 1), and the number of additional 
edges 2(fc — 1) — = — 2. Now consider a non-binarized 
network with n nodes. Clearly, binarization introduces more 
additional nodes by having more edges between nodes. The 
worst case is a clique. Then, assuming n > 4, binarization 
adds n — 3 new nodes for each node with n — 1 parents, 
leading to n{n — 2) total nodes. The number of edges per 
node increases from (n— 1) to 2{n — 2). Figure 11 compares 



1) to 2(n-2). 

the original number of nodes or edges with the binarized 
version, showing that the increase in number of edges is 
bounded by factor 2 and increase in number of edges and 
nodes by factor 3. □ 

Remark. Note that the cascading for the binarization 
has to be done with some care. [Figure 12b| and |Fig. 12c] 
show two possible approaches for binarization of the acyclic 
network in Fig. 12a (note the different orders of cascading). 
Whereas both binarized networks have the same stable so- 
lutions in the acyclic network, this symmetry does not hold 
anymore for cyclic networks: Fig. 12f| is an incorrect bina- 
rization of the cyclic network |Fig. 12c] as Z2 and zi are sym- 



metric in the binarized version, leading to incorrect stable 
solutions. 

B.4 Logic program equivalence 

Here we prove [Theorem 2^ Instead of using unary pred- 
icates Ux{v) and Cx,y{v) for the Logic Program (LP) formu- 
lation as in [Sect. 2.3| we use a binary predicate poss(x,v) 
and a ternary predicate conf(x,y,v), respectively. Also, 
throughout this section, we use the actual syntax of DLV [12] 






(a) acyclic non- 
binary network 



(b) correct bina- 
rization of (a) 



zi 
0-1 



X Z2 
■2—0 




(c) incorrect bi- 
narization of (a) 



zi X y Z2 




23 

(d) cyclic non- 
binary network 



z?, 

(e) correct bina- 
rization of (d) 



zz 

(f) incorrect bi- 
narization of (d) 



Figure 12: Correct binarization of a trust network 
has to cascade from parents with lower priority to 
parents with higher priority as in (b) and (e). 



to write LPs that can be readily executed by DLV''. This 
translation of binary trust networks (BTNs) into LPs was 
used for the experiments in [Sect. 5] Recall that the focus is 
on one single key. 

constants begin with a lowercase 
whereas variables begin with an 
Extensional database predicates 



In the syntax of DLV 
letter (e.g. x, zl and w) 
uppercase letter (e.g. X) 
(EDBs) such as 



poss(zl,v) . 

encode explicit beliefs, here that node zi believes the value v. 
Intensional database predicates (IDBs) correspond to rules 
such as: 

poss(x,X) :- poss(zl,X). 

Executing both rules together as a logic program under the 
brave stable model semantics will deliver two result tuples 
poss(zl,v) and poss(x,v) with the second tuple being in- 
tensional and following from the LP. See [Example B.f] for a 
detailed example. 



Proof Theorem 2.9 (Logic Program Equivalence). 
We show that every stable solution to a BTN is a stable 
model to the associated LP, and vice versa. We give the 
transformation and the proof in one since the later follows 
directly the construction. 

Transformation and equivalence. In a BTN, each 
node X has either (a) no parent, (b) one parent, (c) two par- 
ents with different priorities, or (d) two parents with equal 
priorities. For cases (a) to (d), we assume that node x has 
no explicit belief and consider a separate case (e) if x has 
an explicit belief irrespective of the number of parents. For 
each of those 5 cases, we give a translation into a logic pro- 
gram (LP) and later show equivalence between the stable 
solutions of the BTN and the stable models of the LP. 



(a) If node x has neither explicit belief nor parents ( Fig. 13a I 
then the LP contains no rule with head poss(x,...). 



http : //www. dbai . tuwien . ac . at/proj/dlv/ 
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Z2 
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X 

(a) 




X 

(c) 




Figure 13: Four cases to be considered for translat- 
ing the subgraph of a node without explicit beliefs 
and its parents into a logic program. 



As consequence, all stable models have an empty set 
for values of x. Similarly, all stable solutions have no 
value for x. As a consequence, stable solutions and 
stable models are identical. 



(d) 



(b) If node x has no explicit belief but one parent z { Fig. 13b I , 
then the LP for x contains one rule 

poss(x,X) :- poss(z,X). 

This rule guarantees that, in all stable models, all pos- 
sible values for z are also possible values for x. This 
corresponds exactly to the stable solutions, hence they 
are identical. 

(c) If node x has no explicit belief but two parents with 
different priorities (Fig. 13c I, then the LP consists of 
three rules: 



poss(x,X) 
conf (x,zl ,X) 
poss(x,X) 



poss(z2,X) . 
poss(zl ,X) , 
poss(zl ,X) , 



poss(x,Y) , Y!=X. 
not conf (x,zl ,X) . 



The first rule guarantees that, as in case (b), in all 
stable models, all possible values from the preferred 
parent Z2 are also possible values for x. The second and 
third rule together guarantee that all possible values of 
the non-preferred parent zi that are not conflicting with 
a possible value of a: in a given stable model, are also 
possible values of x in the same stable model. This rule 
corresponds exactly to the rule of stable solutions that 
the value of the non-preferred parent will only be used 
if it is not conflicting with the value of the preferred 
parent and, hence, the node x itself. Hence, stable 
solutions and stable models are identical. 
If node X has no explicit belief but two parents with 
equal priorities ( |Fig. 13d| ), then the LP consists of four 
rules: 



conf (x,zl ,X) 
poss(x,X) 
conf (x,z2,X) 
poss(x,X) 



poss(zl,X), poss(x,Y), Y!=X. 

poss(zl,X), not conf (x,zl ,X) , 

poss(z2,X), poss(x,Y), Y!=X. 

poss(z2,X), not conf (x,z2 ,X) , 



Rule 1,2 and 3,4 are the same as rules 2,3 in case (c). 
Together, they guarantee that in each stable solution, 
node X has exactly one of the values of their parents zi 
and Z2 if they have conflicting values. That means, if 
both parents together have possible values {vi, . . . ,Vk}, 
then there are exactly k different possible values for x. 
This corresponds exactly to the deflnition of a stable 
solution for the corresponding trust network. Hence, 
stable models and stable solutions are again identical. 
If node X has an explicit belief v, then the only rule 
specifled is an extensional rule 

poss(x,v) . 



No other rule refers to poss(x,...), hence all stable 
models contain v as only value for x. Again stable 
solutions and stable models are identical. 
Since all 5 above mutually exclusive cases exhaust all pos- 
sible subgraphs for each node in a BTN, they together give 
a translation of a given BTN into a LP with the same sta- 
ble models as the stable solutions for the BTN. Evaluating 
this LP under either the brave or the cautious stable model 
semantics give either the possible or certain values of the 
corresponding trust network. □ 

Example B.l (Logic program with DLV). Consider 
the binary trust network of Fig. 13c and assume 60(21) = v 
and 60(^2) = w. The corresponding logic program is 



poss(zl,v) . 
poss(z2,w) . 
poss(x,X) 
conf (x,zl ,X) 
poss(x,X) 



poss(z2,X) . 

poss(zl,X), poss(x,Y), Y!=X. 
poss(zl,X), not conf (x,zl ,X) . 



which we save as text file input . txt . In addition, we store 
the string "poss(X,U) ?"in a separate text file query.txt, 
which states a query for all tuples that appear in the in- 
tensional database predicate poss. We then execute DLV 
with the command dlv . bin -brave input . txt query . txt 
which issues the query over the logic program under the 
brave stable model semantics. DLV then returns three tuples 
(zl,v), (z2,w), (x,v) from which we learn that node x 
has only one possible value v. 

Similarly, the logic program for the binary trust network 
of Fig. 13d for 60(21) = v and 60(2:2) = w is 



poss(zl,v) . 
poss(z2,w) . 
conf (x,zl ,X) 
poss(x,X) 
conf (x,z2 ,X) 
poss(x,X) 



- poss(zl,X) , 

- poss(zl,X) , 

- poss(z2,X) , 

- poss(z2,X) , 



poss(x,Y), Y!=X. 
not conf (x , zl , X) . 
poss(x,Y), Y!=X. 
not conf (x , z2 , X) . 



Executing this program results in four tuples (zl , v) , (z2 , w) , 
(x,v) , (x,w) from which we learn that node x has two pos- 
sible values V and w. 

Remark 1. An alternative transformation is one in which 
case (e) is not treated differently. This can be achieved by 
creating a special node xq for each original node x that rep- 
resents a parent with higher priority than any other parent. 
If node X has an explicit belief, this is then assigned as ex- 
tensional predicate to the node xq. The advantage of this 
alternative transformation is that all intensional rules are 
given by the trust network topology, independent of the ex- 
plicit beliefs. The disadvantage is that the translation is 
larger since an extra parent node is created even for nodes 
without explicit beliefs, and the encoding of the parents is 
accounted for even if the node has an explicit belief. 

Remark 2. Binarization is not essential for translating 
a TN into a LP. However, it simplifles the LP and reduces 
its size. Let n be the number of nodes in TN and k be the 
average number of parents of each node. The size of the 
resulting LP, i.e. the number of intensional rules, is 0{nk) 
when the network is binarized. This follows from the fact 
that each node with k parents gets binarized into maximum 
k — 1 nodes, each of which has a maximum of four intensional 
rules in case (d). Hence, the size is 0{nk). 
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However, if a trust network gets translated directly with- 
out binarization, the resulting LP is 0{nk^). The quadratic 
dependence on the number of parents results from the de- 
pendence of each parent on all parents with higher priority. 
This can be either encoded by 0{k) number of rules per par- 
ent, or rules of size 0{k). In addition, we for parents that 
share the priority with another parent, we need another rule 
specifies only one possible value per stable model. Instead 
of giving the formalities explicitly, we illustrate with the fol- 
lowing two examples. 

Example B. 2 (LP for non-binary TN). Consider the 
non-binary TN of \Fig. 12a\ and assume no node has explicit 
values. The corresponding LP is 



poss(x,X) 
conf (x,z2,X) 
poss(x,X) 
conf (x,zl ,X) 
conf (x,zl ,X) 
poss(x,X) 



poss(z3,X) . 



- poss(z2,X) 

- poss(z2,X) 

- poss(zl,X) 

- poss(zl,X) 

- poss(zl,X) 



poss(z3,Y), Y!=X. 
not conf (x , z2 , X) . 
poss(z3,Y), Y!=X. 
poss(z2,Y), Y!=X. 
not conf (x , zl , X) . 



Note that 3 rules are necessary for parent z\ which is possible 
blocked by 2 parents with higher priority. 

Next consider the non-binary TN of \Fig. i"Qa| and assume 
no node has exphcit values. The corresponding LP is 



poss 


(x,X) 




poss(z7,X) 






conf 


(x,z6,X) 




poss(z6,X) 


poss(z7,Y) 


Y!=X 


poss 


(x,X) 




poss(z6,X) 


not conf (x 


z6,X) 


conf 


(x,z5,X) 




poss(z5,X) 


poss(z7,Y) 


Y!=X 


conf 


(x,z5,X) 




poss(z5,X) 


poss(z6,Y) 


Y!=X 


conf 


(x,z5,X) 




poss(z5,X) 


poss(x,Y) , 


Y!=X. 


poss 


(x,X) 




poss(z5,X) 


not conf (x 


z5,X) 


conf 


(x,z4,X) 




poss(z4,X) 


poss(z7,Y) 


Y!=X 


conf 


(x,z4,X) 




poss(z4,X) 


poss(z6,Y) 


Y!=X 


conf 


(x,z4,X) 




poss(z4,X) 


poss(x,Y) , 


Y!=X. 


poss 


(x,X) 




poss(z4,X) 


not conf (x 


z4,X) 


conf 


(x,z3,X) 




poss(z3,X) 


poss(z7,Y) 


Y!=X 


conf 


(x,z3,X) 




poss(z3,X) 


poss(z6,Y) 


Y!=X 


conf 


(x,z3,X) 




poss(z3,X) 


poss(x,Y) , 


Y!=X. 


poss 


(x,X) 




poss(z3,X) 


not conf (x 


z3,X) 


conf 


(x,z2,X) 




poss(z2,X) 


poss(z7,Y) 


Y!=X 


conf 


(x,z2,X) 




poss(z2,X) 


poss(z6,Y) 


Y!=X 


conf 


(x,z2,X) 




poss(z2,X) 


poss(z5,Y) 


Y!=X 


conf 


(x,z2,X) 




poss(z2,X) 


poss(z4,Y) 


Y!=X 


conf 


(x,z2,X) 




poss(z2,X) 


poss(z3,Y) 


Y!=X 


conf 


(x,z2,X) 




poss(z2,X) 


poss(x,Y) , 


Y!=X. 


poss 


(x,X) 




poss(z2,X) 


not conf (x 


z2,X) 


conf 


(x,zl,X) 




poss(zl,X) 


poss(z7,Y) 


Y!=X 


conf 


(x.zl.X) 




poss(zl,X) 


poss(z6,Y) 


Y!=X 


conf 


(x,zl,X) 




poss(zl,X) 


poss(z5,Y) 


Y!=X 


conf 


(x,zl,X) 




poss(zl,X) 


poss(z4,Y) 


Y!=X 


conf 


(x.zl.X) 




poss(zl,X) 


poss(z3,Y) 


Y!=X 


conf 


(x.zl.X) 




poss(zl,X) 


poss(x,Y) , 


Y!=X. 


poss 


(x,X) 




poss(zl,X) 


not conf (x 


zl,X) 



Note that parent Z2 has 7 rules tn total: 5 "blocking rules" for 
each of the 5 parents with higher priority, one "blocking rule" 
to allow only one belief (since z\ and Z2 share priorities) , 
and one "import rule". 

B.5 Quadratic worst case scenario 



— O RA 

Y = le-7 



100 1,000 10,000 100,000 

Size of the network [x= | U | + 1 E | ] 



Figure 15: The RA (Algorithm 1| runs in quadratic 
time on the parameterized trust network of |Fig. 14a[ 

number of nodes. Concretely, we show that RA runs in time 
quadratic of the size of the parameterized graph in |Fig. 14al 
Taking k as parameter, the graph has n{k) = 5 -f 6fc nodes 
and m(fc) = 5 + lOfc edges, i.e. its size is linear in k. Start- 
ing at nodes z\ and Z2 , RA calculates k times the connected 
components of the remaining nodes when arriving at nodes 
and j/j,4. Hence, RA runs in quadratic time of the size of 
this network. [Figure 14b| shows this progression and |Fig. 15| 
shows experimental evidence. 

Remark. Note that we only showed that our algorithm 
is O(n^), not the problem. We doubt, but have not proven, 
that there is an algorithm that can run provably faster on 
any trust network and without prior knowledge of the topol- 
ogy of the graph. On the other hand, it seems very unlikely 
that any reasonable social network shows this regularity of 
"nested connected components" as illustrated with |Fig. 14a| 
that is required for quadratic scalability. 

B.6 Details on the hardness proof 



Proof [Theorem 3.41 The proof is reduction from the 
CNF SAT problem: given a formula "I> over Boolean vari- 
ables Xi , . . . , Xn in CNF, determine whether there is a truth 
assignment of the variables so that the formula evaluates to 
true. We construct a BTN where all explicit beliefs (positive 
or negative) are over six data values a, b, c, d, e, f, and where 
f-\- is a possible value for a distinguished node Z iff there 
exists a satisfying assignment for <1> ( [Fig. 16f| . The key tech- 
nical step is that Boolean gates NOT, OR, and AND can be 
encoded as BTNs, and each of those gates changes the al- 
phabet. Hence, we construct the BTN representing $ level 
by level, and at each level we change the encoding of 1 (= 
true) and (= false) ( |Fig. 17} . 





1 = true 


= false 


Level 1 


b+ 


a+ 


Level 2 


d+{a-,b-) 


c+(a— , 6—) 


Level 3 


d+(a— , 6—, c— ) 


e+(a— , 6—, c— ) 


Level 4 


f-\~{a~,b-,c-,d-) 


e+(a— , b—, c— , d— ) 



We ne xt show that the resolution algorithm (RA) Algo ^ 
rithm l| is indeed 0{n^) in the worst case where n is the 



Figure 17: Encoding of truth value at 4 levels of the 
BTN. Values in parenthesis show additional negative 
beliefs for the Eclectic paradigm. 

We start at level 1 with a b+/a-\~ oscillator for each vari- 
able Xi in <E> ( [Fig. 16a| . That is, there is a node Xi for 



17 



2/1,2 2/2,2 yk,2 




(a) BTN with size 0(k) 




(b) Nested SSCs 



Figure 14: (a) BTN which grows hnear in size with parameter k, and for which RA needs 0{k^) time to 
determine value assignments. The reason is the "nestedness" of the connected components, which requires 
repeated application of Tar j an' s algorithm (b). 



each i G {1, . . . ,n} whose possible values are b+ and a+, 
representing 1 and 0, respectively. 

At level 2, we construct a maximum of two new nodes X} 
and Xf for each variable Xi, which represent Xi and -^Xi, 
respectively, and whose possible beliefs are d+/c+. Xf is 
obtained from a NOT gate, X} is obtained from a PASS- 
THROUGH gate. Whereas the inputs of a NOT gate are 
b+/a+ representing 1/0, the outputs are c + /d+ represent- 
ing 0/1. Thus the gate performs a negation. Consider the 
NOT gate in Fig. 16b The inputs 1/0 are encoded as beliefs 
b+/a+, the outputs are encoded as c+/d+. When the input 
Xi is b+ for 1, then the output Xf is c+ for 0. This is be- 
cause b+ is blocked at the node with preferred parent {b—}, 
hence c+ advances to the output (the parentheses show the 
additional negative beliefs that are propagated in the Eclec- 
tic paradigm). Similarly, one can check that if is a+ for 
0, the output Xf is d+ for 1. Thus, the network maps 
b+/a+ to c+/d+, hence it is a NOT. If we modify the net- 
work by switching c with d, we obtain a PASS-THROUGH 



gate which maps b+/a+ to d+/c+ (see Fig. 16c I 



Next, we apply an OR-gate for each clause in CNF ex- 
pression $ and obtain level 3 nodes, where t he 1/0 enc oding 
is d+/e+. Consider the ternary OR gate in Fig. 16d if at 
least one the three inputs is d+ for 1, it will propagate to 
the output. If all inputs are c+ then all positive beliefs are 
blocked, and the output is e+ for 0. Thus, the encoding of 
the output is d+/e+ for 1/0. 

Finally, we construct one AND-gate which leads to the 
single node Z at level 4, and whose possible positive values 
are f+/e+, representing 1/0. [Figure 16e| illustrates a 3-way 
AND gate, which clearly generalizes to a fc-way AND gate 
for any k. 

By combining these gates, making sure that each level uses 
the same encoding of Boolean values as positive beliefs, we 
can represent an CNF expression where the last level encodes 



1/0 as f+/e+. Figure 16 illustrates the entire encoding of a 
SAT (Ai V ^A2)A(A2VA3), which generalizes to any CNF 
SAT. Notice the role of the PASS-THROUGH gates (the 
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{a-} {b+la+} 



{6+} {a+] 





{a-} [h+la+} 
5X, 



{b-(a-)ld+{a-b-)} 



{<;+} 



{b+(a-)ld+(a-)) 
{c+} 



(a) Oscillator — ^ (6+/a+) 



{c+{a-b-}ld+{a-b-]} 

(b) NOT (6+/a+) ^ (c+/d+) 




{6-{a-)/c+(a-,6-)} 



{c+} 



-{6+(a-)/c+(a-)} 
{d+} 



{d+(a- 6-)} 

(c) PASS-THROUGH (fe+/a+) ^ (d+/cH 



{c-} {d+/c+} {c-} {d+lc+} {c-} (d+/c+] 



{d-} {d+/(;+} {d-} {d+/e+} {d-} {d+/f.+} 




level 1 



level 2 6X 



{e + (c-)/d+(c-)} 

(d) OR (d+/c+) ^ (d+/e+) 



{/+(d-)/e+(d-)} 

(e) AND (d+/e+) ^ (/+/e+) 




level 3 



level 4 

(f) SAT of (XiV^X2)A(X2VX3) 



Figure 16: Oscillator (a), Pass-through gate (b), NOT gate (c), OR gate (d), AND gate (e), and example 
CNF SAT encoding of (Xi V -.X2) A (X2 V X3). 



Case 


Condition of repPoss(a;) 


poss(a::) 


cert(2;) 


1 
2 
3 

4 
5 


repPoss(2:) has only negative beliefs 
repPoss(a;) contains _L and negative beliefs 

v-\- is the sole positive belief in repPoss(a;) and v— ^ repPoss(a;) 
w-l- is the sole positive belief in repPoss(a;) and v— G repPoss(a;) 
. . . ,Vk-\- are all positive beliefs in repPoss(a;) and k > 2 


repPoss(x) 

_L 

{v+}U{±-{v-}) 
{v+} U _L 

{«!+,..., «fc+}U_L 


repPoss(a;) 
_L 

{v+}U{±-{v-}) 
±-{v-} 

_L - {vi-, . . .,Vk-} 



Figure 18: Encoding of positive and negative possible and certain values in repPoss(a;) after [Algorithm 2| 
terminates. Projecting away all non-positive values gives positive possible and certain beliefs. 



rectangles) in ensuring that all values at the second level 
have the same encoding c+/d+. 

The reduction is completed by the observation that the 
CNF formula is satisfiable iff /+ £ poss(Z), where Z is the 
output node. This proves the first claim of the theorem. 
The second claim follows from the fact that checking non- 
satisfiability of CNF formulas is coNP-hard, and that the 
formula is unsatisfiable iff e+ G cert(Z). □ 

B.7 Details on the Skeptic Resolution Algorithm 

The correctness proof extends the proof of [Algorithm 1[ 
The only change from before is that if there is a preferred 
edge z ^ X, and 2 is closed but repPoss(2;) is of Type 1, 
then the algorithm cannot yet close the node x. This is 
because x can further receive some positive values through 
non-preferred edges. 

At the end, each node may contain positive beliefs v+, 
negative beliefs w— and _L. [Figure 18] illustrates five dif- 
ferent cases for repPoss(a::) and the set of possible and cer- 
tain values that it represents after the algorithm terminates. 
Note that this set represents both positive and negative be- 



liefs. From poss(a::) and cert(a;), one can easily restrict to 
just the positive possible and certain beliefs. 

B.8 Acyclic trust networks 



Proof IProp. 3"6] When a trust network is acyclic, then 
there is a partial order ^ between all nodes in the network. 
Visiting each node in any linear extension < of this partial 
order, i.e. any total order that is consistent with the par- 
tial order, a node is always visited after all of its parents. 
Furthermore, if both preferred and non-preferred parent of 
a node are closed then it's value can directly be calculated 
by applying the preferred union. Hence, all values can be 
determined in 0{n). □ 

B.9 Conflict resolution with constraints and 
ties 

If we allow both constraints and ties between between 
parents of a node, then the definition of a stable solution 
( [Def. 3.3] l has to be adapted. We generalize the random tie- 
breaking of [Def. 2.4] by imposing a random order between 
non-preferred parents, then applying the overriding union in 
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exactly this order: 

Definition B.3 (Stable solution w/ constraints 2). 
Let a € {A, E, S}, and let BTN = {U, E, Bq) be a binary trust 
network, where for all x, Bo{x) is either a positive belief, or 
a set of negative beliefs, or the empty set. A stable solution 
is a function B from users to sets of beliefs such that: 

(1) Ifx has a preferred parent y and a non-preferred parent 
z, then B{x) = Bo{x)0^{B{y)U^B{z)). 

(2) If X has two non-preferred parents y and z, then either 
B{x) = Bo{x)Ua{B{y)UaB{z)), or B{x) = Bo{x)yj„ 
{B{z)Ci^B{x)). 

(3) If X has only one parent y, then B{x) = Bo{x)UaB{y). 

(4) If X has no parent, then B{x) = Normcr[Bo{x)Y 

(5) For every belief b £ B{x) there exists a path xo — > 
xi . . . ^ x„ — X such that b G Nornia (^Bo{xo)^ and 
b £ B{xi) for all i — 0, . . . ,n. 

Note that the order in which the overriding union is ap- 
plied corresponds to the cascading for binarization described 
in |Fig. 12| This allows to define the stable solutions for 
non-binary trust networks as well, so that the logic of bina- 
rization of [Sect. B.3| applies. Hence, again each non- binary 
trust network can be translated into an equivalent binary 
trust network. 

Definition B.4 (Stable solution w/ constraints 3). 
Let a € {A,E,S}, and let TN — {U,E,Bo) be a binary trust 
network, where for all x, Bq{x) is either a positive belief, or 
a set of negative beliefs, or the empty set. A stable solution 
is a function B from users to sets of beliefs such that for 
each node x in the network the following holds: 

(1) Let yi with i € {0, . . . , fc} be the parents of x with their 
priorities defining a total preorder <. Then there ex- 
ists a linear extension of < of the total preorder with 
yi < y2 < ■ ■ ■ < yk so that B{x) = Norma{Bo{x)) 

a^{B{yk)(Ja iB{yk-i) ■ ■ ■ U<,B(yi) ■•■)). 

(2) For every belief b £ B{x) there exists a path xo — > 
xi . . . Xn ~ X such that b G Norma {^Boixff)) and 
b G B{xi) for all i — 0, . . . ,n. 

B.IO Details on Bulk Inserts 

Remember the logic program formulation from |Sect. B.4[ 
We extend this schema with one more attribute K for the key 
of the value. Hence, we have one single relation PDSS (X , K , V) 
that stores the appropriate value V for each user X and each 
key K. 

We make the two following key assumptions: 

(i) The set of trust mappings is the same for each object 
ki, i.e. a user x trusts a user z globally, for all objects. 

(ii) If a user has an explicit belief for an object ki, then the 
user has an explicit belief for each of the objects. 

These two assumptions imply that the resolution algorithm 
resolves nodes in the same order across all keys. As a con- 
sequence, we need to run the resolution algorithm on the 
network only once to determine the sequence of resolution 
steps, then apply those across all keys at the same time. 

Whenever step 1 ( |S1| | is applied, then all values from the 
preferred parent z are copied to the child x {z ^ x): 
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Figure 19: Non-binary network used for the bulk 
insert experiments. Dark nodes show users with ex- 
pUcit beliefs. 



For step 2 ([S2f, the algorithm determines a minimal SCC 
of the open nodes, then calculates poss(a::i), for all nodes 
Xi G SCC as the union of all possible values of all parents 
zi , . . . Zfe of nodes in SCC. 



insert into POSS 

select distinct • 

from POSS t 

where t . X = ' z\' 



x^> AS X, t.K, t.V 



t.X 



' zu ' 



Here the union is replaced by the logical or. Since we include 
the keys at each step, the values across different keys are kept 
separate. 

Note that every node is visited only once. As a con- 
sequence, the number of SQL statements is linear in the 
size of the network. Determining the right sequence is still 
quadratic in the worst case, but is performed only once for 
the network. Hence, the resulting algorithm is quadratic in 
the size of the network, but linear in the number of objects. 

Also note that our two assumptions are arguably strong: 
If they do not hold, then the resolution across different keys 
cannot be combined, and the number of SQL queries can 
be linear in the number of nodes and number of keys. It 
remains to be seen whether clever mechanism can still ex- 
ploit common resolution patterns across different keys, in 
the general case. 
Finally, |Fig. 
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experiments from 



shows the network that was used for the 



Fig. 8c| 



insert into POSS 

select 'x' AS X, t.K, 

from POSS t 

where t . X = ' z' 



t.V 
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